CICS region logonid(s) are not defined and/or controlled in accordance with the security requirements.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-44	ZCIC0040	SV-7533r2_rule	DCCS-1 DCCS-2 ECCD-1 ECCD-2	Medium

Description
CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.

Description

CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.

STIG	Date
z/OS TSS STIG	2015-03-27

Details

Check Text ( C-25315r1_chk )
a) Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(CICSPROC) Refer to the following reports produced by the TSS Data Collection: - TSSCMDS.RPT(@ACID) - TSSCMDS.RPT(#STC) Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. b) Ensure the following items are in effect for each CICS region ACID. 1) A unique ACID is associated with the CICS region. 2) No access to interactive on-line facilities (e.g., TSO) other than CICS. 3) CICS region ACID does not have any BYPASS privilege. EXCEPT: NOSUBCHK - REQUIRED FOR CICS REGIONS TO SUBMIT BATCH PROCESSING/JOBS OF THE USER WHO IS LOGGED INTO CICS. 4) Ensure that each CICS region ACID is uniquely associated with a TSS CICS facility. For example: TSS ADD(CICS region ACID) MASTFAC(CICS facility) 5) CICS region is defined in the STC table. For example: TSS ADD(STC) PROCNAME(CICS region) ACID(CICS ACID) c) If (b) are true, there is NO FINDING. d) If (b) are untrue, this is a FINDING.

Check Text ( C-25315r1_chk )

a) Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC)

Refer to the following reports produced by the TSS Data Collection:

- TSSCMDS.RPT(@ACID)
- TSSCMDS.RPT(#STC)

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

b) Ensure the following items are in effect for each CICS region ACID.

1) A unique ACID is associated with the CICS region.
2) No access to interactive on-line facilities (e.g., TSO) other than CICS.
3) CICS region ACID does not have any BYPASS privilege. EXCEPT: NOSUBCHK - REQUIRED FOR CICS REGIONS TO SUBMIT BATCH PROCESSING/JOBS OF THE USER WHO IS LOGGED INTO CICS.
4) Ensure that each CICS region ACID is uniquely associated with a TSS CICS facility. For example:

TSS ADD(CICS region ACID) MASTFAC(CICS facility)

5) CICS region is defined in the STC table. For example:

TSS ADD(STC) PROCNAME(CICS region) ACID(CICS ACID)

c) If (b) are true, there is NO FINDING.

d) If (b) are untrue, this is a FINDING.

Fix Text (F-18515r1_fix)
Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required. Ensure the following items are in effect for each CICS region ACID. 1) A unique ACID is associated with the CICS region. 2) No access to interactive on-line facilities (e.g., TSO) other than CICS. 3) CICS region ACID does not have any BYPASS privilege. 4) Ensure that each CICS region ACID is uniquely associated with a TSS CICS facility. For example: TSS ADD(CICS region ACID) MASTFAC(CICS facility) 5) CICS region is defined in the STC table. For example: TSS ADD(STC) PROCNAME(CICS region) ACID(CICS ACID)

Fix Text (F-18515r1_fix)

Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required.

Ensure the following items are in effect for each CICS region ACID.

1) A unique ACID is associated with the CICS region.

2) No access to interactive on-line facilities (e.g., TSO) other than CICS.

3) CICS region ACID does not have any BYPASS privilege.

4) Ensure that each CICS region ACID is uniquely associated with a TSS CICS facility.

For example:
TSS ADD(CICS region ACID) MASTFAC(CICS facility)

5) CICS region is defined in the STC table.

For example:
TSS ADD(STC) PROCNAME(CICS region) ACID(CICS ACID)