Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-118 | ACP00120 | SV-118r5_rule | DCCS-1 DCCS-2 ECAR-1 ECAR-2 ECAR-3 ECCD-1 ECCD-2 | High |
Description |
---|
The ACP database files contain all access control information for the operating system environment and system resources. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data. |
STIG | Date |
---|---|
z/OS TSS STIG | 2015-03-27 |
Check Text ( C-17924r3_chk ) |
---|
Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(ACPRPT) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ACP00120) Verify that the accesses to the ACP security data sets and/or databases are properly restricted. If the following guidance is true, this is not a finding. ___ The ACP data set rules for ACP security data sets and/or databases restrict READ access to auditors and DASD batch. ___ The ACP data set rules for ACP security data sets and/or databases restrict READ and/or greater access to z/OS systems programming personnel, security personnel, and/or batch jobs that perform ACP maintenance. ___ All (i.e., failures and successes) data set access authorities (i.e. READ, UPDATE, ALTER, and CONTROL) for ACP security data sets and/or databases are not logged. NOTE: For RACF the dataset that contains the REXX for Password exit must be included in these files. Examine system REXLIB concatenation for this dataset name. |
Fix Text (F-17102r3_fix) |
---|
Review access authorization to critical security database files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes required to protect the ACP Files. Ensure that READ and/or greater access to all ACP files and/or databases are limited to system programmers and/or security personnel, and/or batch jobs that perform ACP maintenance. READ access can be given to auditors and DASD batch. All accesses to ACP files and/or databases are logged. NOTE: For RACF the dataset that contains the REXX for Password exit must be included in these files. Examine system REXLIB concatenation for this dataset name. |