The number of ACIDs possessing the tape Bypass Label Processing (BLP) privilege is not limited.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-241	TSS0930	SV-241r2_rule	DCCS-1 DCCS-2	Medium

Description
BLP is extremely sensitive, as it allows the circumvention of security access checking for the data. If an unauthorized user possesses BLP authority, they could potentially read any restricted tape and modify any information once it has been copied.

STIG	Date
z/OS TSS STIG	2016-12-21

Details

Check Text ( C-576r1_chk )
a) Refer to the following reports produced by the TSS Data Collection: - TSSCMDS.RPT(@ACIDS) - SENSITVE.RPT(WHOHVOL) b) Using the reports listed in (a) above, review the ACIDs that have BLP access. Verify that only authorized personnel have BLP access and that documentation for access is on file with the IAO. c) If (b) above is correct, there is NO FINDING. d) If (b) above is incorrect, this is a FINDING.

Check Text ( C-576r1_chk )

a) Refer to the following reports produced by the TSS Data Collection:

- TSSCMDS.RPT(@ACIDS)
- SENSITVE.RPT(WHOHVOL)

b) Using the reports listed in (a) above, review the ACIDs that have BLP access. Verify that only authorized personnel have BLP access and that documentation for access is on file with the IAO.

c) If (b) above is correct, there is NO FINDING.

d) If (b) above is incorrect, this is a FINDING.

Fix Text (F-18195r1_fix)
Review all ACIDs with the BLP attribute. Evaluate the impact of removing BLP access from unauthorized personnel. Develop a plan of action and remove BLP access from unauthorized ACIDs.