z/OS system commands must be properly protected.

From z/OS RACF STIG

Part of ACP00282

Associated with: CCI-000213 CCI-002234 CCI-002235

SV-7919r4_rule z/OS system commands must be properly protected.

Vulnerability discussion

z/OS system commands provide a method of controlling the operating environment. Failure to properly control access to z/OS system commands could result in unauthorized personnel issuing sensitive system commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.

Check content

From a command input screen enter: RLIST OPERCMDS * ALL Alternately: Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(ACP00282) - SENSITVE.RPT(OPERCMDS) (Alternate report) Automated Analysis: Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ACP00282) The MVS.** resource is defined to the OPERCMDS class with a default access of NONE and all (i.e., failures and successes) access logged. Access to z/OS system commands defined in the table entitled Required Controls on z/OS System Commands, in the z/OS STIG Addendum, is restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users). NOTE: Use the GROUP category specified in the table referenced above as a guideline to determine appropriate personnel access to system commands. NOTE: The (MVS.SEND) Command will not be a finding if used by all. All access (i.e., failures and successes) to specific z/OS system commands is logged as indicated in the table entitled Required Controls on z/OS System Commands, in the z/OS STIG Addendum. If any of the above is untrue for any z/OS system command resource, this is a FINDING. If all of the above are true, there is NO FINDING.

Fix text

z/OS system commands provide control over z/OS functions and can compromise security if misused. These commands are subject to various types of potential abuse. For this reason, it is necessary to place restrictions on the z/OS system commands that can be entered by particular operators. Some commands are particularly dangerous and should only be used when all less drastic options have been exhausted. Misuse of these commands can create a situation in which the only recovery is an IPL. Apply the following recommendations when implementing security: The MVS.** resource is defined to the OPERCMDS class with an access of NONE and all (i.e., failures and successes) access logged. Access to z/OS system commands defined in the "Required Controls on z/OS System Commands" table in the zOS STIG Addendum is restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users). NOTE: Use the GROUP category specified in the table referenced above as a guideline to determine appropriate personnel access to system commands. NOTE: The (MVS.SEND) Command will not be a finding if used by all. All access (i.e., failures and successes) to specific z/OS system commands is logged as indicated in the table entitled "Required Controls on z/OS System Commands" in the zOS STIG Addendum. A sample set of commands to define and permit access to system command resources is shown here: RDEF OPERCMDS MVS.** UACC(NONE) OWNER() AUDIT(ALL(READ)) DATA("set up deny-by-default profile per srr pdi acp00282') Then, in accordance with the referenced table, use the following template to define profiles for each command: RDEF OPERCMDS UACC(NONE) OWNER() AUDIT(ALL(READ)) PERMIT CLASS(OPERCMDS) ID() ACCESS()

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer