On Classified Systems, Logical Partition must be restricted with read/write access to only its own IOCDS.

From IBM Hardware Management Console (HMC) STIG

Associated with IA controls: ECCD-2, ECCD-1

Associated with: CCI-000213

SV-30053r2_rule On Classified Systems, Logical Partition must be restricted with read/write access to only its own IOCDS.

Vulnerability discussion

Unrestricted control over the IOCDS files could result in unauthorized updates and impact the configuration of the environment by allowing unauthorized access to a restricted resource. This could severely damage the integrity of the environment and the system resources.

Check content

Using the Hardware Management Console, verify that a logical partition cannot read or write to any IOCDS. Use the Security Definitions Page panel to do this by checking to see if the Input/Output (I/O) Configuration Control option has been turned on. NOTE: The default is applicable to only classified systems. Confirm whether or not the I/O Configuration Control option is checked. If the Logical Partition is not restricted with read/write access to only its own IOCDS, this is a FINDING.

Fix text

Review the Security Definition parameters specified under Processor Resource/Systems Manager (PR/SM). Verify and implement the correct settings.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.