Batch jobs are improperly defined.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-17839	RACF0595	SV-19114r2_rule	DCCS-1 DCCS-2	Medium

Description
Batch jobs are submitted to the operating system under their own USERID. This will identify the batch job with the user for the purpose of accessing resources. BATCHALLRACF ensures that a valid USERID is associated with batch jobs. Jobs that are submitted to the operating system via a scheduling facility must also be identified to the system. Without a batch job having an associated USERID, access to system resources will be limited.

Description

Batch jobs are submitted to the operating system under their own USERID. This will identify the batch job with the user for the purpose of accessing resources. BATCHALLRACF ensures that a valid USERID is associated with batch jobs. Jobs that are submitted to the operating system via a scheduling facility must also be identified to the system. Without a batch job having an associated USERID, access to system resources will be limited.

STIG	Date
z/OS RACF STIG	2016-01-04

Details

Check Text ( C-19366r1_chk )
a) Refer to the following report produced by the RACF Data Collection: - RACFCMDS.RPT(LISTUSER) Refer to the documentation of the processes used for submission of batch jobs via an automated process (i.e., scheduler or other sources) and each of the associated userids. b) Ensure that the following items are in effect for batch userids: 1) The following userid record fields/attributes are specified: NAME PROTECTED 2) No userid has the LAST-ACCESS field set to UNKNOWN. c) If both of the above are true, there is NO FINDING. d) If either of the above is untrue, this is a FINDING.

Check Text ( C-19366r1_chk )

a) Refer to the following report produced by the RACF Data Collection:

- RACFCMDS.RPT(LISTUSER)

Refer to the documentation of the processes used for submission of batch jobs via an automated process (i.e., scheduler or other sources) and each of the associated userids.

b) Ensure that the following items are in effect for batch userids:

1) The following userid record fields/attributes are specified:

NAME
PROTECTED

2) No userid has the LAST-ACCESS field set to UNKNOWN.

c) If both of the above are true, there is NO FINDING.

d) If either of the above is untrue, this is a FINDING.

Fix Text (F-17759r1_fix)
Ensure the following: 1. Associated USERIDs exist for all batch jobs and documentation authorizing access to system resources is maintained and implemented. 2. Set up the userids with the RACF PROTECTED attribute. A sample RACF command to accomplish is shown here: ALU NOPASSWORD NOOIDCARD.