UCF STIG Viewer Logo

JES2 output devices must be properly controlled for Classified Systems.


Overview

Finding ID Version Rule ID IA Controls Severity
V-6922 ZJES0032 SV-74871r1_rule Medium
Description
JES2 output devices provide a variety of channels to which output can be processed. Failure to properly control these output devices could result in unauthorized personnel accessing output. This exposure may compromise the confidentiality of customer data on a classified System..
STIG Date
z/OS RACF STIG 2019-12-12

Details

Check Text ( C-168r3_chk )
Refer to the following report produced by the Data Set and Resource Data Collection:

- Classification of System
- SENSITVE.RPT(WRITER)

If the Classification of the system is unclassified, this is not applicable.

Verify that the accesses for WRITER resources are restricted. If the following guidance is true, this is not a finding.

___ The RACF resources and/or generic equivalent are defined with a default access of NONE.

___ The RACF resources and/or generic equivalent identified below will be defined with access restricted to the operators and system programming personnel:

JES2.LOCAL.devicename
JES2.LOCAL.OFFn.*
JES2.LOCAL.OFFn.JT
JES2.LOCAL.OFFn.ST
JES2.LOCAL.PRTn
JES2.LOCAL.PUNn
JES2.NJE.nodename
JES2.RJE.devicename

NOTE: Common sense should prevail during the analysis. For example, access to the offload output destinations should be limited to only systems personnel (e.g., operations staff/system programmers) on a classified system.

___ The RACF resource access authorizations are defined with UACC(NONE) and NOWARNING.
Fix Text (F-6626r3_fix)
Verify with the ISSO to see that access authorization for resources defined to the WRITER resource class is restricted to the operators and system programmers on a classified system only.

Define resources in the ACP’s respective WRITER class for each of the following output destinations:

JES2.LOCAL.devicename
JES2.LOCAL.OFFn.*
JES2.LOCAL.OFFn.JT
JES2.LOCAL.OFFn.ST
JES2.LOCAL.PRTn
JES2.LOCAL.PUNn
JES2.NJE.nodename
JES2.RJE.devicename

The resource definition will be generic if all of the resources of the same type have identical access controls (e.g., if all off load transmitters are equivalent). If all users are permitted to route output to a specific destination, the resource controlling it may be defined with a default access of either NONE or READ. Otherwise it will be defined with a default access of NONE.