Volume access greater than CREATE found in CA-Top Secret (TSS) database must be limited to authorized information technology personnel requiring access to perform their job duties.

From z/OS TSS STIG

Part of TSS1030

Associated with IA controls: DCCS-1, DCCS-2

Associated with: CCI-000213

SV-247r3_rule Volume access greater than CREATE found in CA-Top Secret (TSS) database must be limited to authorized information technology personnel requiring access to perform their job duties.

Vulnerability discussion

Access authorization to data sets is verified by examining both volume access and data set access authorization. If a user has been authorized for any volume access greater than CREATE, then TSS allows access to the volume without checking the data set authorizations. A user could potentially alter a data set that resides on a volume even though access has not been granted to that data set.

Check content

a) Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(WHOHVOL) b) Determine whether or not access authorization greater than CREATE (e.g. CONTROL or ALL) has been granted for volumes. c) If access authorizations for volumes are within the requirements, there is NO FINDING. d) If access authorization for volumes exceeds the requirements without justification, this is a FINDING. NOTE: Domain level DASD Administrators who are responsible for the Domain level DASD/storage administration. Volume level access to those team members who are directly responsible and perform Domain level DASD/Storage administration may be granted access to all volumes via PRIVPGM controls.

Fix text

The IAO will ensure that VOLUME access authorization greater than CREATE is not permitted unless authorized by the IAO. Review all access to VOLUMEs. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the required changes. *Noted Exception: Domain level DASD Administrators who are responsible for the Domain level DASD/storage administration. Volume level access to those team members who are directly responsible and perform Domain level DASD/Storage administration may be granted access to all volumes via PRIVPGM controls. Domain Level DASD/Storage administrators access should be granted VOL(*ALL*)ACC(ALL)ACTION(AUDIT)PRIVPGM(list of privileged programs)

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer