Emergency ACIDs must be properly limited and auditing resource access.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-233	TSS0850	SV-233r3_rule	DCCS-1 DCCS-2	High

Description
All emergency ACIDs should contain information identifying the ACID to an individual. Without this, accountability could be impaired. Since these are powerful ACIDs, it is imperative that all trace I information be maintained for the user.

STIG	Date
z/OS TSS STIG	2019-03-26

Details

Check Text ( C-20019r1_chk )
Refer to the following reports produced by the TSS Data Collection: - TSSCMDS.RPT(@ACIDS) - TSSCMDS.RPT(@ALL) Refer to the following report produced by the z/OS Data Collection: - EXAM.RPTS(TSOUADS) Refer to the list from the IAO of all emergency userids available to the site along with the associated function of each. Note: If running Quest NC-Pass, validate in ZNCP0020 that the Emergency ACIDS are identified as part of ZNCP0020 to have the FACILITY of NCPASS and SECURID resource in the ABSTRACT resource class. If at a minimum, an emergency ACID exists with the security administration attributes specified in accordance with the following requirements, this is not a finding. For emergency IDs with security administration privileges, but which cannot access and update system data sets: ADMIN Authority: ACID(ALL) DATA(ALL) OTRAN(ALL) MISC1(INSTDATA,SUSPEND,TSSSIM,NOATS) MISC2(TSO,TARGET) MISC8(PWMAINT,REMASUSP) MISC9(GENERIC) FACILITY(BATCH, TSO, ROSCOE, CICS, xxxx) Where ‘xxxx’ is a facility the application security team grants access into for their application users. An additional class of userids can exist to perform all operating system functions except ACP administration. These emergency ACID(s) will have ability to access and update all system data sets, but will not have security administration privileges. See the following requirements: Data set permissions for the emergency ACIDs will be permitted as follows: TSS PER(acid) DSN(*****) ACCESS(ALL) ACTION(AUDIT) Security Bypass Attributes NODSNCHK, NOVOLCHK, and NORESCHK will not be given to the Emergency ACIDs. All emergency ACID(s) are to be implemented with logging to provide an audit trail of their activities. All emergency ACID(s) are to be maintained in both the ACP and SYS1.UADS to ensure they are available in the event that the ACP is not functional. All emergency ACID(s) will have distinct, different passwords in SYS1.UADS and in the ACP, and the site is to establish procedures to ensure that the passwords differ. The password for any ID in SYS1.UADS is never to match the password for the same ID in the ACP. All emergency ACID(s) will have documented procedures to provide a mechanism for the use of the IDs. Their release for use is to be logged, and the log is to be maintained by the IAO. When an emergency ACID is released for use, its password is to be reset by the IAO within 12 hours. 1) Review the access authorizations for all emergency ACIDs to ensure that all access permitted to these ACIDs is reviewed and approved by the IAO. 2) If emergency ACIDs are utilized, ensure they are restricted to performing only the operating system recovery functions or the ACP administration functions.

Check Text ( C-20019r1_chk )

Refer to the following reports produced by the TSS Data Collection:

- TSSCMDS.RPT(@ACIDS)
- TSSCMDS.RPT(@ALL)

Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPTS(TSOUADS)

Refer to the list from the IAO of all emergency userids available to the site along with the associated function of each.

Note: If running Quest NC-Pass, validate in ZNCP0020 that the Emergency ACIDS are identified as part of ZNCP0020 to have the FACILITY of NCPASS and SECURID resource in the ABSTRACT resource class.

If at a minimum, an emergency ACID exists with the security administration attributes specified in accordance with the following requirements, this is not a finding.

For emergency IDs with security administration privileges, but which cannot access and update system data sets:

ADMIN Authority:
ACID(ALL)
DATA(ALL)
OTRAN(ALL)
MISC1(INSTDATA,SUSPEND,TSSSIM,NOATS)
MISC2(TSO,TARGET)
MISC8(PWMAINT,REMASUSP)
MISC9(GENERIC) FACILITY(BATCH, TSO, ROSCOE, CICS, xxxx)
Where ‘xxxx’ is a facility the application security team grants access into for their application users.

An additional class of userids can exist to perform all operating system functions except ACP administration.

These emergency ACID(s) will have ability to access and update all system data sets, but will not have security administration privileges. See the following requirements:

Data set permissions for the emergency ACIDs will be permitted as follows:

TSS PER(acid) DSN(*****) ACCESS(ALL) ACTION(AUDIT)

Security Bypass Attributes NODSNCHK, NOVOLCHK, and NORESCHK will not be given to the Emergency ACIDs.

All emergency ACID(s) are to be implemented with logging to provide an audit trail of their activities.

All emergency ACID(s) are to be maintained in both the ACP and SYS1.UADS to ensure they are available in the event that the ACP is not functional.

All emergency ACID(s) will have distinct, different passwords in SYS1.UADS and in the ACP, and the site is to establish procedures to ensure that the passwords differ. The password for any ID in SYS1.UADS is never to match the password for the same ID in the ACP.

All emergency ACID(s) will have documented procedures to provide a mechanism for the use of the IDs. Their release for use is to be logged, and the log is to be maintained by the IAO. When an emergency ACID is released for use, its password is to be reset by the IAO within 12 hours.

1) Review the access authorizations for all emergency ACIDs to ensure that all access permitted to these ACIDs is reviewed and approved by the IAO.
2) If emergency ACIDs are utilized, ensure they are restricted to performing only the operating system recovery functions or the ACP administration functions.

Fix Text (F-18163r1_fix)
Review all emergency ACIDs and ensure access granted is limited to resources required to support the specific functions of the owning department and that access to these resources is audited. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes.