Security control ACIDs must be limited to the administrative authorities authorized and that require these privileges to perform their job duties.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-240	TSS0920	SV-240r3_rule	DCCS-1 DCCS-2	High

Description
Since control ACIDs possess a significant amount of power, it is important to limit the number of control ACIDs. These ACIDs can perform and control security administration. An ACID who possesses control over security administration could alter or modify any data set, and delete any audit trail that might have existed for the file.

STIG	Date
z/OS TSS STIG	2017-06-26

Details

Check Text ( C-20051r1_chk )
a) Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(@ADMIN) b) Determine if any ACIDs other than TYPE=CENTRAL (SCA/MSCA) has the following administrative authority: FACILITIES(ALL) PROGRAM(ALL) PROGRAM(OWN) RESOURCE(ALL) ROSRES(ALL) VOLUME(ALL) VOLUME(OWN) MISC1(ALL) MISC1(LCF) MISC1(LTIME) MISC1(RDT) MISC1(USER) MISC2(ALL) MISC2(DLF) MISC2(NDT) MISC2(SMS) MISC4(ALL) MISC8(ALL) MISC8(LISTAPLU) MISC8(LISTRDT) MISC8(LISTSDT) MISC8(LISTSTC) MISC8(MCS) MISC9(ALL) MISC9(BYPASS) MISC9(CONSOLE) MISC9(GLOBAL) MISC9(MASTFAC) MISC9(MODE) MISC9(STC) MISC9(TRACE) Additionally, decentralized security administrators shall not have scope/control over DISA internal system/domain level resources. c) The following are “approved” Examples for other types (DCA, VCA, ZCA, LSCA) that require administrative authorities: (note: these are examples and does not mean everyone should have all of these levels). DATASET(ALL)ACC(ALL) DATASET(XAUTH,OWN,REPORT,AUDIT,INFO)ACC(ALL) OTRAN(ALL)ACC(ALL) ACID(ALL) ACID(INFO,MAINTAIN) MISC1(INSTDATA,SUSPEND,TSSSIM,NOATS) MISC2(TSO,TARGET) MISC8(PWMAINT,REMASUSP) MISC9(GENERIC) FACILITY(BATCH, TSO, ROSCOE, CICS, xxxx) Where ‘xxxx’ is a facility the application security team grants access into for their application users. This shall not be STC, CA1, DFHSM or other “domain level mastfac/facility. This is only for those “onlines” that users truly log into to access their applications/data such as TSO, CICS regions, IDMS, ROSCOE, FTP, etc. TSS ADMIN(acid)RESOURCE(REPORT,INFO,AUDIT) can be allowed and is required to run TSSUTIL reports. Note: “RESOURCE” can specify a more specific Resource Class, such as “OTRAN”, “DATASET”, “IDMSGON”, “PROGRAM” for non SCA/MSCA type of accounts. These administrators will not have “RESOURCE” specified in administrative authority. Note: “ALL” will display as “ALL” but also means approved for any single administrative authority under that specific item. d) If no item in (b) above is found on any TYPE=DCA, VCA, ZCA, LSCA, USER, PROFILE, there is NO FINDING. e) If any item in (b) above is found on TYPE=DCA, VCA, ZCA, LSCA, USER, PROFILE, this is a FINDING.

Check Text ( C-20051r1_chk )

a) Refer to the following report produced by the TSS Data Collection:

- TSSCMDS.RPT(@ADMIN)

b) Determine if any ACIDs other than TYPE=CENTRAL (SCA/MSCA) has the following administrative authority:

FACILITIES(ALL)
PROGRAM(ALL)
PROGRAM(OWN)
RESOURCE(ALL)
ROSRES(ALL)
VOLUME(ALL)
VOLUME(OWN)

MISC1(ALL)
MISC1(LCF)
MISC1(LTIME)
MISC1(RDT)
MISC1(USER)

MISC2(ALL)
MISC2(DLF)
MISC2(NDT)
MISC2(SMS)

MISC4(ALL)

MISC8(ALL)
MISC8(LISTAPLU)
MISC8(LISTRDT)
MISC8(LISTSDT)
MISC8(LISTSTC)
MISC8(MCS)

MISC9(ALL)
MISC9(BYPASS)
MISC9(CONSOLE)
MISC9(GLOBAL)
MISC9(MASTFAC)
MISC9(MODE)
MISC9(STC)
MISC9(TRACE)

Additionally, decentralized security administrators shall not have scope/control over DISA internal system/domain level resources.

c) The following are “approved” Examples for other types (DCA, VCA, ZCA, LSCA) that require administrative authorities: (note: these are examples and does not mean everyone should have all of these levels).

DATASET(ALL)ACC(ALL)
DATASET(XAUTH,OWN,REPORT,AUDIT,INFO)ACC(ALL)
OTRAN(ALL)ACC(ALL)
ACID(ALL)
ACID(INFO,MAINTAIN)
MISC1(INSTDATA,SUSPEND,TSSSIM,NOATS)
MISC2(TSO,TARGET)
MISC8(PWMAINT,REMASUSP)
MISC9(GENERIC)
FACILITY(BATCH, TSO, ROSCOE, CICS, xxxx)

Where ‘xxxx’ is a facility the application security team grants access into for their application users. This shall not be STC, CA1, DFHSM or other “domain level mastfac/facility. This is only for those “onlines” that users truly log into to access their applications/data such as TSO, CICS regions, IDMS, ROSCOE, FTP, etc.

TSS ADMIN(acid)RESOURCE(REPORT,INFO,AUDIT) can be allowed and is required to run TSSUTIL reports.

Note: “RESOURCE” can specify a more specific Resource Class, such as “OTRAN”, “DATASET”, “IDMSGON”, “PROGRAM” for non SCA/MSCA type of accounts. These administrators will not have “RESOURCE” specified in administrative authority.

Note: “ALL” will display as “*ALL*” but also means approved for any single administrative authority under that specific item.

d) If no item in (b) above is found on any TYPE=DCA, VCA, ZCA, LSCA, USER, PROFILE, there is NO FINDING.

e) If any item in (b) above is found on TYPE=DCA, VCA, ZCA, LSCA, USER, PROFILE, this is a FINDING.

Fix Text (F-18192r1_fix)
Review all security administrator ACIDs. Evaluate the impact of limiting the amount of excessive administrative authorities. Develop a plan of action and implement the changes.