There are GSO MAINT records that do not have corresponding maintenance LOGONIDs.

Associated with IA controls: DCCS-1, DCCS-2

Associated with: CCI-002145 CCI-002883 CCI-003014

SV-167r2_rule There are GSO MAINT records that do not have corresponding maintenance LOGONIDs.

Vulnerability discussion

LOGONIDs could be intentionally created that correspond to the GSO MAINT records. Then the maintenance programs could be used to gain unauthorized access to the system. This could result in the compromise of the confidentiality, integrity, and availability of the operating system, ACP, and customer data.

Check content

a) Refer to the following reports produced by the ACF2 Data Collection: - ACF2CMDS.RPT(ACFGSO) - ACF2CMDS.RPT(ATTMAINT) Automated Analysis Refer to the following report produced by the ACF2 Data Collection Checklist: - PDI(ACF0670) b) If every GSO MAINT record has a corresponding maintenance logonid, there is NO FINDING. c) If any GSO MAINT record does not have a corresponding maintenance logonid, this is a FINDING.

Fix text

The IAO will ensure that an associated user logonid exists for each special GSO maintenance record identifying the program(s) that it is permitted to access and the library where the program(s) resides. An associated GSO MAINT record will exist for each special user logonid, identifying the program(s) that it is permitted to access and the library where the program(s) resides. Example: SET LID CHANGE DFSMSHSM MAINT

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.