The LOGONID with the ACCTPRIV attribute must be restricted to the IAO.

Associated with IA controls: DCCS-1, DCCS-2

SV-173r1_rule The LOGONID with the ACCTPRIV attribute must be restricted to the IAO.

Vulnerability discussion

Individuals with the ACCTPRIV could add or delete users in SYS1.UADS and jeopardize the availability of the operating system, ACP, and customer data.

Check content

Refer to the following report produced by the ACF2 Data Collection: - ACF2CMDS.RPT(ATTACPRV) Automated Analysis Refer to the following report produced by the ACF2 Data Collection: - PDI(ACF0770) Ensure that logonids with the ACCTPRIV attribute specified are assigned to the IAO.

Fix text

The IAO will ensure Logonids with the ACCTPRIV attribute are only reserved for use by the IAOs and/or IAMs. The ACCTPRIV attribute cannot be scoped, and will be restricted exclusively to a site IAO: Example: SET LID CHANGE logonid ACCTPRIV

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.