The ACP security data sets and/or databases must be properly protected.

From z/OS ACF2 STIG

Part of ACP00120

Associated with: CCI-000213 CCI-001499 CCI-002234 CCI-002357

SV-118r6_rule The ACP security data sets and/or databases must be properly protected.

Vulnerability discussion

The Access Control Program (ACP) database files contain all access control information for the operating system environment and system resources. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.

Check content

Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(ACPRPT) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ACP00120) Verify that the accesses to the ACP security data sets and/or databases are properly restricted. If the following guidance is true, this is not a finding. ___ The ACP data set rules for ACP security data sets and/or databases restrict READ access to auditors and DASD batch. ___ The ACP data set rules for ACP security data sets and/or databases restrict READ and/or greater access to z/OS systems programming personnel, security personnel, and/or batch jobs that perform ACP maintenance. ___ All (i.e., failures and successes) data set access authorities (i.e. READ, UPDATE, ALTER, and CONTROL) for ACP security data sets and/or databases are logged.

Fix text

Review access authorization to critical security database files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes required to protect the ACP Files. Ensure that READ and/or greater access to all ACP files and/or databases are limited to system programmers and/or security personnel, and/or batch jobs that perform ACP maintenance. READ access can be given to auditors and DASD batch. All accesses to ACP files and/or databases are logged.

Pro Tips

Powered by sagemincer