PASSWORD data set and OS passwords are utilized.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-107	AAMV0440	SV-107r2_rule	DCCS-1 DCCS-2 ECCD-1 ECCD-2	Medium

Description
All protection of system resources must come from the ACP. If multiple protection mechanisms are in place, the accessibility of data, specifically under contingency plan execution, is subject to compromise.

STIG	Date
z/OS RACF STIG	2019-12-12

Details

Check Text ( C-660r1_chk )
a) Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(PASSWORD) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(AAMV0440) b) If, based on the information provided, it can be determined that the system PASSWORD data set and OS passwords are not used, there is NO FINDING. c) If it is evident that OS passwords are utilized, this is a FINDING.

Check Text ( C-660r1_chk )

a) Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(PASSWORD)

Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:

- PDI(AAMV0440)

b) If, based on the information provided, it can be determined that the system PASSWORD data set and OS passwords are not used, there is NO FINDING.

c) If it is evident that OS passwords are utilized, this is a FINDING.

Fix Text (F-17032r1_fix)
System programmers will ensure that the old OS Password Protection is not used and any data protected by the old OS Password technology is removed and protection is replaced by the ACP. Review the contents of the PASSWORD data set. Ensure that any protections it provides are provided by the ACP and delete the PASSWORD data set. Access to data sets on z/OS systems can be protected using the OS password capability of MVS. This capability has been available in MVS for many years, and its use is commonly found in data centers. Since the advent of ACPs, the use of OS passwords for file protection has diminished, and is commonly considered archaic and of little use. The use of z/OS passwords is not supported by all the ACPs.

Fix Text (F-17032r1_fix)

System programmers will ensure that the old OS Password Protection is not used and any data protected by the old OS Password technology is removed and protection is replaced by the ACP.

Review the contents of the PASSWORD data set. Ensure that any protections it provides are provided by the ACP and delete the PASSWORD data set.

Access to data sets on z/OS systems can be protected using the OS password capability of MVS. This capability has been available in MVS for many years, and its use is commonly found in data centers. Since the advent of ACPs, the use of OS passwords for file protection has diminished, and is commonly considered archaic and of little use. The use of z/OS passwords is not supported by all the ACPs.