IBM System Display and Search Facility (SDSF) HASPINDX data set identified in the INDEX parameter must be properly protected.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-21592	ZISFR002	SV-40731r1_rule	DCSL-1 ECAR-1 ECAR-2 ECCD-1 ECCD-2	Medium

Description
IBM System Display and Search Facility (SDSF) HASPINDX data set control the execution, configuration, and security of the SDSF products. Failure to properly protect access to these data sets could result in unauthorized access. This exposure may threaten the availability of SDSF, and compromise the confidentiality of customer data.

STIG	Date
z/OS IBM System Display and Search Facility (SDSF) for RACF STIG	2015-09-28

Details

Check Text ( C-25963r1_chk )
Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(SDSFRPT) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZISF0002) Verify that the accesses to the IBM System Display and Search Facility (SDSF) HASPINDX data set specified on the INDEX control statement in the ISFPARMS statements (identified in the SFSFPARM DD statement of the SDSF stc) are properly restricted. If the following guidance is true, this is not a finding. ___ The RACF data set rules for the data sets restricts READ access to the auditors. ___ The RACF data set rules for the data sets restricts UPDATE access to SDSF Started Tasks. ___ The RACF data set rules for the data sets restricts WRITE and/or greater access to systems programming personnel. ___ The RACF data set rules for the data sets specify UACC(NONE) and NOWARNING. Note: If running z/OS V1R11 or above, with the use of a new JES logical log, the HASPINDX, may not exist and may make this vulnerability not applicable (N/A). However if used the HASPINDX dataset must be restricted. Note: If running z/OS V1R11 systems or above and NOT using JES logical log, the HASPINDX data set must be protected.

Check Text ( C-25963r1_chk )

Refer to the following report produced by the Data Set and Resource Data Collection:

- SENSITVE.RPT(SDSFRPT)

Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:

- PDI(ZISF0002)

Verify that the accesses to the IBM System Display and Search Facility (SDSF) HASPINDX data set specified on the INDEX control statement in the ISFPARMS statements (identified in the SFSFPARM DD statement of the SDSF stc) are properly restricted. If the following guidance is true, this is not a finding.

___ The RACF data set rules for the data sets restricts READ access to the auditors.

___ The RACF data set rules for the data sets restricts UPDATE access to SDSF Started Tasks.

___ The RACF data set rules for the data sets restricts WRITE and/or greater access to systems programming personnel.

___ The RACF data set rules for the data sets specify UACC(NONE) and NOWARNING.

Note: If running z/OS V1R11 or above, with the use of a new JES logical log, the HASPINDX, may not exist and may make this vulnerability not applicable (N/A). However if used the HASPINDX dataset must be restricted.

Note: If running z/OS V1R11 systems or above and NOT using JES logical log, the HASPINDX data set must be protected.

Fix Text (F-18796r1_fix)
The IAO will ensure that the HASPINDX dataset identified in the INDEX parameter value of ISFPARMS options statement is restricted as described below. The HASPINDX data set is used by SDSF when building the SYSLOG panel. This data set contains information related to all SYSLOG jobs and data sets on the spool. Since SDSF dynamically allocates this data set, explicit user access authorization to this data set should not be required. Due to the potentially sensitive data in this data set, access authorization will be restricted. READ access is restricted to the auditors. UPDATE access is restricted to SDSF Started Tasks. WRITE and/or greater access is restricted to systems programming personnel. Note: If running z/OS V1R11 or above, with the use of a new JES logical log, the HASPINDX, may not exist and may make this vulnerability not applicable (N/A). However if used the HASPINDX dataset must be restricted. Note: If running z/OS V1R11 systems or above and NOT using JES logical log, the HASPINDX data set must be protected. Data sets to be protected will be: SYS1.ISF.AISF SYS1.ISF.SISF The following commands are provided as a sample for implementing data set controls: AD 'sys1.haspindx.' UACC(NONE) OWNER(SYS1) AUDIT(FAILURES(READ)) PE ' sys1.haspindx.' ID(syspaudt) ACC(A) PE ' sys1.haspindx.' ID(sdsf stc) ACC(U) PE ' sys1.haspindx.' ID(audtaudt) ACC(R)

Fix Text (F-18796r1_fix)

The IAO will ensure that the HASPINDX dataset identified in the INDEX parameter value of ISFPARMS options statement is restricted as described below.

The HASPINDX data set is used by SDSF when building the SYSLOG panel. This data set contains information related to all SYSLOG jobs and data sets on the spool. Since SDSF dynamically allocates this data set, explicit user access authorization to this data set should not be required. Due to the potentially sensitive data in this data set, access authorization will be restricted.

READ access is restricted to the auditors.

UPDATE access is restricted to SDSF Started Tasks.

WRITE and/or greater access is restricted to systems programming personnel.

Note: If running z/OS V1R11 or above, with the use of a new JES logical log, the HASPINDX, may not exist and may make this vulnerability not applicable (N/A). However if used the HASPINDX dataset must be restricted.

Note: If running z/OS V1R11 systems or above and NOT using JES logical log, the HASPINDX data set must be protected.

Data sets to be protected will be:
SYS1.ISF.AISF
SYS1.ISF.SISF

The following commands are provided as a sample for implementing data set controls:

AD 'sys1.haspindx.**' UACC(NONE) OWNER(SYS1) AUDIT(FAILURES(READ))

PE ' sys1.haspindx.**' ID(syspaudt) ACC(A)
PE ' sys1.haspindx.**' ID(sdsf stc) ACC(U)
PE ' sys1.haspindx.**' ID(audtaudt) ACC(R)