z/OS system commands must be properly protected.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-7482	ACP00282	SV-7919r4_rule		Medium

Description
z/OS system commands provide a method of controlling the operating environment. Failure to properly control access to z/OS system commands could result in unauthorized personnel issuing sensitive system commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.

STIG	Date
z/OS RACF STIG	2019-12-12

Details

Check Text ( C-75043r1_chk )
From a command input screen enter: RLIST OPERCMDS * ALL Alternately: Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(ACP00282) - SENSITVE.RPT(OPERCMDS) (Alternate report) Automated Analysis: Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ACP00282) The MVS.** resource is defined to the OPERCMDS class with a default access of NONE and all (i.e., failures and successes) access logged. Access to z/OS system commands defined in the table entitled Required Controls on z/OS System Commands, in the z/OS STIG Addendum, is restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users). NOTE: Use the GROUP category specified in the table referenced above as a guideline to determine appropriate personnel access to system commands. NOTE: The (MVS.SEND) Command will not be a finding if used by all. All access (i.e., failures and successes) to specific z/OS system commands is logged as indicated in the table entitled Required Controls on z/OS System Commands, in the z/OS STIG Addendum. If any of the above is untrue for any z/OS system command resource, this is a FINDING. If all of the above are true, there is NO FINDING.

Check Text ( C-75043r1_chk )

From a command input screen enter:
RLIST OPERCMDS * ALL

Alternately:
Refer to the following report produced by the Data Set and Resource Data Collection:

- SENSITVE.RPT(ACP00282)
- SENSITVE.RPT(OPERCMDS) (Alternate report)

Automated Analysis:
Refer to the following report produced by the Data Set and Resource Data Collection:

- PDI(ACP00282)

The MVS.** resource is defined to the OPERCMDS class with a default access of NONE and all (i.e., failures and successes) access logged.

Access to z/OS system commands defined in the table entitled Required Controls on z/OS System Commands, in the z/OS STIG Addendum, is restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users).

NOTE: Use the GROUP category specified in the table referenced above as a guideline to determine appropriate personnel access to system commands.

NOTE: The (MVS.SEND) Command will not be a finding if used by all.

All access (i.e., failures and successes) to specific z/OS system commands is logged as indicated in the table entitled Required Controls on z/OS System Commands, in the z/OS STIG Addendum.

If any of the above is untrue for any z/OS system command resource, this is a FINDING.

If all of the above are true, there is NO FINDING.

Fix Text (F-6838r2_fix)
z/OS system commands provide control over z/OS functions and can compromise security if misused. These commands are subject to various types of potential abuse. For this reason, it is necessary to place restrictions on the z/OS system commands that can be entered by particular operators. Some commands are particularly dangerous and should only be used when all less drastic options have been exhausted. Misuse of these commands can create a situation in which the only recovery is an IPL. Apply the following recommendations when implementing security: The MVS. resource is defined to the OPERCMDS class with an access of NONE and all (i.e., failures and successes) access logged. Access to z/OS system commands defined in the "Required Controls on z/OS System Commands" table in the zOS STIG Addendum is restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users). NOTE: Use the GROUP category specified in the table referenced above as a guideline to determine appropriate personnel access to system commands. NOTE: The (MVS.SEND) Command will not be a finding if used by all. All access (i.e., failures and successes) to specific z/OS system commands is logged as indicated in the table entitled "Required Controls on z/OS System Commands" in the zOS STIG Addendum. A sample set of commands to define and permit access to system command resources is shown here: RDEF OPERCMDS MVS. UACC(NONE) OWNER() AUDIT(ALL(READ)) DATA("set up deny-by-default profile per srr pdi acp00282') Then, in accordance with the referenced table, use the following template to define profiles for each command: RDEF OPERCMDS UACC(NONE) OWNER() AUDIT(ALL(READ)) PERMIT CLASS(OPERCMDS) ID() ACCESS()

Fix Text (F-6838r2_fix)

z/OS system commands provide control over z/OS functions and can compromise security if misused. These commands are subject to various types of potential abuse. For this reason, it is necessary to place restrictions on the z/OS system commands that can be entered by particular operators.

Some commands are particularly dangerous and should only be used when all less drastic options have been exhausted. Misuse of these commands can create a situation in which the only recovery is an IPL.

Apply the following recommendations when implementing security:

The MVS.** resource is defined to the OPERCMDS class with an access of NONE and all (i.e., failures and successes) access logged.

Access to z/OS system commands defined in the "Required Controls on z/OS System Commands" table in the zOS STIG Addendum is restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users).

NOTE: Use the GROUP category specified in the table referenced above as a guideline to determine appropriate personnel access to system commands.

NOTE: The (MVS.SEND) Command will not be a finding if used by all.

All access (i.e., failures and successes) to specific z/OS system commands is logged as indicated in the table entitled "Required Controls on z/OS System Commands" in the zOS STIG Addendum.

A sample set of commands to define and permit access to system command resources is shown here:

RDEF OPERCMDS MVS.** UACC(NONE) OWNER() AUDIT(ALL(READ)) DATA("set up deny-by-default profile per srr pdi acp00282')

Then, in accordance with the referenced table, use the following template to define profiles for each command:

RDEF OPERCMDS UACC(NONE) OWNER() AUDIT(ALL(READ))

PERMIT CLASS(OPERCMDS) ID() ACCESS()