Access to the TSS MODE resource class is inappropriate.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-19893	TSS0780	SV-22058r2_rule	DCCS-1 DCCS-2	High

Description
Access to the resources in the MODE resource class overrides the security mode in which an Acid will operate for all facilities. Acids with permission to these resources can compromise the security of the processing environment. In addition, failure to restrict access to these resources introduces the possibility of exposure during migration process or contingency plan activation.

STIG	Date
z/OS TSS STIG	2019-03-26

Details

Check Text ( C-25456r1_chk )
a) Refer to the following reports produced by the TSS Data Collection and Data Set and Resource Data Collection: - SENSITVE.RPT(WHOHMODE) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(TSS0780) b) If any ACIDs is permitted a mode of DORM, WARN, or IMPL, this is FINDING. c) If all ACIDs are permitted to mode of FAIL or do not have any permissions to the MODE resource class, there is NO FINDING.

Check Text ( C-25456r1_chk )

a) Refer to the following reports produced by the TSS Data Collection and Data Set and Resource Data Collection:

- SENSITVE.RPT(WHOHMODE)

Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:

- PDI(TSS0780)

b) If any ACIDs is permitted a mode of DORM, WARN, or IMPL, this is FINDING.

c) If all ACIDs are permitted to mode of FAIL or do not have any permissions to the MODE resource class, there is NO FINDING.

Fix Text (F-20607r1_fix)
The IAO will evaluate the impact associated with implementation of the removal of this access. Develop a plan of action to ensure that the ACIDs use the default MODE settings and proceed with the change.