Dataset masking characters are not properly defined to the security database.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22	TSS1000	SV-22r2_rule	DCCS-1 DCCS-2	Medium

Description
TSS provides masking as an additional method for reducing the number of entries that must be made to secure the installation data sets. Shared patterns can be used as the operands of data set parameters. If these characters are not defined to the database, each data set name or resource must be specifically entered into the database. This additional workload for security administrator presents the increased possibility of exposure when granting access to data sets.

Description

TSS provides masking as an additional method for reducing the number of entries that must be made to secure the installation data sets. Shared patterns can be used as the operands of data set parameters. If these characters are not defined to the database, each data set name or resource must be specifically entered into the database. This additional workload for security administrator presents the increased possibility of exposure when granting access to data sets.

STIG	Date
z/OS TSS STIG	2019-03-26

Details

Check Text ( C-583r1_chk )
a) Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(WHOODSN) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(TSS1000) b) Review ownership of all dataset masking characters. (*, %, and +) c) If dataset masking characters are owned by the MSCA, there is NO FINDING. d) If all dataset masking characters are defined, there is NO FINDING. e) If any of the above is untrue, this is a FINDING.

Check Text ( C-583r1_chk )

a) Refer to the following report produced by the TSS Data Collection:

- TSSCMDS.RPT(WHOODSN)

Automated Analysis
Refer to the following report produced by the Data Set and Resource Data Collection:

- PDI(TSS1000)

b) Review ownership of all dataset masking characters. (*, %, and +)

c) If dataset masking characters are owned by the MSCA, there is NO FINDING.

d) If all dataset masking characters are defined, there is NO FINDING.

e) If any of the above is untrue, this is a FINDING.

Fix Text (F-3238r1_fix)
The IAO will ensure that the MSCA owns all dataset masking characters. Review the resource definitions for dataset masking characters ensuring they are defined to the security database. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the required changes. Example TSS commands to protect masking characters: TSS ADD(msca) DSN(*) TSS ADD(msca) DSN(%) TSS ADD(msca) DSN(+)

Fix Text (F-3238r1_fix)

The IAO will ensure that the MSCA owns all dataset masking characters.

Review the resource definitions for dataset masking characters ensuring they are defined to the security database. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the required changes.

Example TSS commands to protect masking characters:

TSS ADD(msca) DSN(*)
TSS ADD(msca) DSN(%)
TSS ADD(msca) DSN(+)