CICS region logonid(s) must be defined and/or controlled in accordance with the security requirements.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-44	ZCIC0040	SV-7532r3_rule		Medium

Description
CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS region userids may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data. The region userid should be associated with a unique RACF userid.

Description

CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS region userids may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data. The region userid should be associated with a unique RACF userid.

STIG	Date
z/OS RACF STIG	2018-12-20

Details

Check Text ( C-62551r1_chk )
a) Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(CICSPROC) Refer to the following reports produced by the RACF Data Collection: - RACFCMDS.RPT(LISTUSER) - DSMON.RPT(RACCDT) Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. b) Ensure that the following is defined for each CICS region: 1) A unique userid is defined. 2) Defined to the STARTED resource class. c) If (b) is true, this is not a finding. d) If (b) is untrue, this is a finding.

Check Text ( C-62551r1_chk )

a) Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC)

Refer to the following reports produced by the RACF Data Collection:

- RACFCMDS.RPT(LISTUSER)
- DSMON.RPT(RACCDT)

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

b) Ensure that the following is defined for each CICS region:

1) A unique userid is defined.
2) Defined to the STARTED resource class.

c) If (b) is true, this is not a finding.

d) If (b) is untrue, this is a finding.

Fix Text (F-18483r1_fix)
Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required. Ensure that the following is defined for each CICS region: 1) A unique userid is defined. Use the RACF Adduser command to accomplish this. A sample command is provided here: AU NAME('STC, CICS Region') DFLTGRP(STC) OWNER(STC) 2) Defined to the STARTED resource class. Use the RACF RDEFINE command. A sample is provided here: RDEF STARTED .** UACC(NONE) OWNER(ADMIN) DATA('USED TO MAP TO A VALID RACF USERID') STDATA(USER(=MEMBER) GROUP(STC) TRACE(YES))

Fix Text (F-18483r1_fix)

Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required.

Ensure that the following is defined for each CICS region:

1) A unique userid is defined.

Use the RACF Adduser command to accomplish this. A sample command is provided here:

AU NAME('STC, CICS Region') DFLTGRP(STC) OWNER(STC)

2) Defined to the STARTED resource class.

Use the RACF RDEFINE command. A sample is provided here:

RDEF STARTED .** UACC(NONE) OWNER(ADMIN) DATA('USED TO MAP TO A VALID RACF USERID') STDATA(USER(=MEMBER) GROUP(STC) TRACE(YES))