z/OS system commands must be properly protected.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-7482	ACP00282	SV-7918r4_rule		Medium

Description
z/OS system commands provide a method of controlling the operating environment. Failure to properly control access to z/OS system commands could result in unauthorized personnel issuing sensitive system commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.

STIG	Date
z/OS ACF2 STIG	2019-12-12

Details

Check Text ( C-75041r2_chk )
From a command screen enter: SET RESOURCE (OPR) SET VERBOSE LIST LIKE (-) NOTE: If CLASMAP defines OPERCMDS as anything other than the default of TYPE(OPR), replace OPR with the appropriate three letters. Alternately: Refer to the following reports produced by the ACF2 Data Collection and Data Set and Resource Data Collection: - SENSITVE.RPT(ACP00282) - SENSITVE.RPT(OPERCMDS) - Alternate report - ACF2CMDS.RPT(RESOURCE) – Alternate report Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ACP00282) The MVS resource is defined to the OPERCMDS class with a default access of PREVENT, and all access logged, i.e., MVS.** is defined with access of PREVENT Access to z/OS system commands defined in the table entitled Required Controls on z/OS System Commands, in the z/OS STIG Addendum, is restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users). NOTE: Use the GROUP category specified in the table referenced above as a guideline to determine appropriate personnel access to system commands. NOTE: The (MVS.SEND) Command will not be a finding if used by all. Access to specific z/OS system commands is logged as indicated in the table entitled Required Controls on z/OS System Commands, in the z/OS STIG Addendum. If any of the above is untrue for any z/OS system command resource, this is a FINDING. If all of the above are true, there is NO FINDING.

Check Text ( C-75041r2_chk )

From a command screen enter:
SET RESOURCE (OPR)
SET VERBOSE
LIST LIKE (-)

NOTE: If CLASMAP defines OPERCMDS as anything other than the default of TYPE(OPR), replace OPR with the appropriate three letters.

Alternately:
Refer to the following reports produced by the ACF2 Data Collection and Data Set and Resource Data Collection:

- SENSITVE.RPT(ACP00282)
- SENSITVE.RPT(OPERCMDS) - Alternate report
- ACF2CMDS.RPT(RESOURCE) – Alternate report

Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:

- PDI(ACP00282)

The MVS resource is defined to the OPERCMDS class with a default access of PREVENT, and all access logged, i.e., MVS.** is defined with access of PREVENT

Access to z/OS system commands defined in the table entitled Required Controls on z/OS System Commands, in the z/OS STIG Addendum, is restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users).

NOTE: Use the GROUP category specified in the table referenced above as a guideline to determine appropriate personnel access to system commands.

NOTE: The (MVS.SEND) Command will not be a finding if used by all.

Access to specific z/OS system commands is logged as indicated in the table entitled Required Controls on z/OS System Commands, in the z/OS STIG Addendum.

If any of the above is untrue for any z/OS system command resource, this is a FINDING.

If all of the above are true, there is NO FINDING.

Fix Text (F-81875r1_fix)
Ensure that z/OS Sensitive System Commands are defined to the OPERCMDS resource class. Only limited number of authorized people are able to issue these commands. All access is logged. Ensure the MVS resource is defined to the OPERCMDS class with a default access of PREVENT, all access is logged, and access is restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users). Note: Ensure access to z/OS system commands defined in the table entitled Required Controls on z/OS System Commands, in the z/OS STIG Addendum, is restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users), Example for ACF2: $KEY(MVS) TYPE(OPR) ACTIVATE.- UID(syspaudt) LOG ACTIVATE.- UID(*) PREVENT SET R(OPR) COMPILE 'ACF2.MVA.OPR(MVS)' STORE F ACF2,REBUILD(OPR)

Fix Text (F-81875r1_fix)

Ensure that z/OS Sensitive System Commands are defined to the OPERCMDS resource class. Only limited number of authorized people are able to issue these commands. All access is logged.

Ensure the MVS resource is defined to the OPERCMDS class with a default access of PREVENT, all access is logged, and access is restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users).

Note: Ensure access to z/OS system commands defined in the table entitled Required Controls on z/OS System Commands, in the z/OS STIG Addendum, is restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users),

Example for ACF2:

$KEY(MVS) TYPE(OPR)
ACTIVATE.- UID(syspaudt) LOG
ACTIVATE.- UID(*) PREVENT

SET R(OPR)
COMPILE 'ACF2.MVA.OPR(MVS)' STORE

F ACF2,REBUILD(OPR)