From z/OS ACF2 STIG
Part of AAMV0160
Associated with IA controls: DCCS-1, DCCS-2
Associated with: CCI-000381
If invalid or inapplicable PPT entries exist, a venue is provided for the introduction of trojan horse modules with security bypass capabilities.
a) Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(PPTXRPT) Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(AAMV0160) b) Review the program entries in the CA-EXAMINE PPT LIBRARY SEARCH report. For all programs not found on the operating system (i.e., missing link date, size, volume, and library name), review their corresponding entries in the CA-EXAMINE PROGRAM PROPERTIES TABLE ANALYSIS report. If a program entry is found with any of the following excessive privileges, ensure that a matching SCHEDxx entry exists for that program revoking these privileges: 1) Data set integrity bypass 2) Keys 0-7 3) Security bypass c) If a SCHEDxx entry exists for all applicable PPT programs revoking the excessive privileges above, there is NO FINDING. d) If a SCHEDxx entry does not exist for an applicable PPT program, or does not revoke all the excessive privileges above, this is a FINDING. Note: Modules for products not in use on the system will have their special privileges explicitly revoked.
The systems programmer will ensure that any invalid entries in the PPT via IEFSDPPT module or invalid entries in the SCHED PPT are nullified by (a) nullifying the invalid IEFSDPPT entry ensuring that there is a corresponding SCHED entry which confers no special attributes, or (b) removing the SCHED PPT entry which is no longer valid if it only exists in this member.
Review the PPT and ensure that all entries associated with non-existent or inapplicable modules are invalidated. As applicable, either: (a) nullify the invalid IEFSDPPT entry by ensuring that there is a corresponding SCHED entry which confers no special attributes, or (b) remove the SCHED PPT entry which is no longer valid.
Some programs require extraordinary privileges not normally permitted by the operating system. The Program Properties Table (PPT) contains the names and properties of these special programs. Programs in the PPT can bypass security software mechanisms such as password protection. Only programs that require special authorizations are coded in the PPT.
The PPT is maintained differently depending upon the level of MVS. Use the following recommendations and techniques to provide protection for the PPT:
(1) As part of standard MVS maintenance, systems programming personnel will review the IEFSDPPT module and all programs that IBM has, by default, placed in the PPT to validate their applicability to the execution system. Please refer to the IBM z/OS MVS Initialization and Tuning Reference documentation for the version and release of z/OS installed at the individual site for the actual contents of the default IEFSDPPT
(2) Modules for products not in use on the system will have their special privileges explicitly revoked. Do this by placing a PPT entry for each module in the SYS1.PARMLIB(SCHEDxx) member, specifying no special privileges. The PPT entry for each overridden program will be in the following format, accepting the default (unprivileged) values for the sub parameters:
PPT PGMNAME(
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer