CICS regions are improperly protected to prevent unauthorized propagation of the region userid.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-224500	ZCICR041	SV-224500r520288_rule		Medium

Description
CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.

Description

CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.

STIG	Date
z/OS IBM CICS Transaction Server for RACF Security Technical Implementation Guide	2021-12-14

Details

Check Text ( C-26183r520286_chk )
a) Refer to the following report produced by the RACF Data Collection: - SENSITVE.RPT(PROPCNTL) Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. b) Ensure the CICS region is defined to the PROPCNTL resource class. c) If (b) are true, there is NO FINDING. d) If (b) is untrue, this is a FINDING.

Fix Text (F-26171r520287_fix)
Utilize propagation control for each CICS region. Under no circumstance should a user's batch job submitted from a CICS region execute under that CICS region's userid. To prevent this from occurring, define a profile in the PROPCNTL resource class for each CICS region. The following is an example: RDEFINE PROPCNTL OWNER(ADMIN) AUDIT(ALL(READ)) The PROPCNTL class must be active and RACLISTed for this protection to be in effect: SETROPTS CLASSACT(PROPCNTL) RACLIST(PROPCNTL)

Fix Text (F-26171r520287_fix)

Utilize propagation control for each CICS region.

Under no circumstance should a user's batch job submitted from a CICS region execute under that CICS region's userid. To prevent this from occurring, define a profile in the PROPCNTL resource class for each CICS region. The
following is an example:
RDEFINE PROPCNTL OWNER(ADMIN) AUDIT(ALL(READ))

The PROPCNTL class must be active and RACLISTed for this protection to be in effect:
SETROPTS CLASSACT(PROPCNTL) RACLIST(PROPCNTL)