The use of the RACF SPECIAL Attribute is not justified.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-293	RACF0710	SV-293r3_rule		Medium

Description
The SPECIAL user attribute allows full authorization to modify all profiles in the RACF database and allows the user to perform all RACF functions, except those requiring AUDITOR attributes. This privilege should be limited to the security group and administrators because of the extreme control that these users have. Users with this privilege can alter any profile or resource on the system and could also alter the audit trail information. The Group-Special attribute allows decentralized RACF control of datasets and resources. In cases where the scope of authority granted to a Group-Special Administrator has an impact on system security, the IAO needs to be fully aware and approve its use.

Description

The SPECIAL user attribute allows full authorization to modify all profiles in the RACF database and allows the user to perform all RACF functions, except those requiring AUDITOR attributes. This privilege should be limited to the security group and administrators because of the extreme control that these users have. Users with this privilege can alter any profile or resource on the system and could also alter the audit trail information. The Group-Special attribute allows decentralized RACF control of datasets and resources. In cases where the scope of authority granted to a Group-Special Administrator has an impact on system security, the IAO needs to be fully aware and approve its use.

STIG	Date
z/OS RACF STIG	2019-09-27

Details

Check Text ( C-19431r2_chk )
a) Refer to the following reports produced by the RACF Data Collection: - DSMON.RPT(RACUSR) - DSMON.RPT(RACGRP) - RACFCMDS.RPT(LISTUSER) Automated Analysis requires Additional Analysis. Refer to the following report produced by the RACF Data Collection: - PDI(RACF0710) b) Ensure the following items are in effect regarding the SPECIAL attribute: 1) Authorization to the SYSTEM SPECIAL attribute is restricted to security personnel. 2) At minimum, ensure that any users connected to sensitive system dataset HLQ groups with the Group-SPECIAL attribute are security personnel. Otherwise, Group-SPECIAL is allowed. c) If both items in (b) are true, there is NO FINDING. d) If either item in (b) is untrue, this is a FINDING.

Check Text ( C-19431r2_chk )

a) Refer to the following reports produced by the RACF Data Collection:

- DSMON.RPT(RACUSR)
- DSMON.RPT(RACGRP)
- RACFCMDS.RPT(LISTUSER)

Automated Analysis requires Additional Analysis.

Refer to the following report produced by the RACF Data Collection:

- PDI(RACF0710)

b) Ensure the following items are in effect regarding the SPECIAL attribute:

1) Authorization to the SYSTEM SPECIAL attribute is restricted to security personnel.
2) At minimum, ensure that any users connected to sensitive system dataset HLQ groups with the Group-SPECIAL attribute are security personnel. Otherwise, Group-SPECIAL is allowed.

c) If both items in (b) are true, there is NO FINDING.

d) If either item in (b) is untrue, this is a FINDING.

Fix Text (F-17832r1_fix)
Review all USERIDs with the SPECIAL attribute. Ensure documentation providing justification for access is maintained and filed with the IAO, and that unjustified access is removed. For the SYSTEM SPECIAL attribute: A sample command for removing the SPECIAL attribute is shown here: ALU NOSPECIAL. For the GROUP SPECIAL attribute: CO GROUP() NOSPECIAL