Site does not have a formal migration plan for removing or upgrading OS systems software prior to the date the vendor drops security patch support.

From z/OS ACF2 STIG

Part of AAMV0014

Associated with IA controls: VIVM-1

SV-8019r1_rule Site does not have a formal migration plan for removing or upgrading OS systems software prior to the date the vendor drops security patch support.

Vulnerability discussion

Vendors' code may contain vulnerabilities that may be exploited to cause denial of service or to violate the integrity of the system or data on the System. Most vendors develop patches to correct these vulnerabilities. When vendors' products become unsupported, the creation of these patches cease leaving the system exposed to any future vulnerabilities not patched.

Check content

a) Refer to Vulnerability Questions within the SRRAUDIT Dialog Management document. Check with the Systems programmer to make sure that documented procedures exist to monitor the software products in the Supported Software Version Release Table in the z/OS STIG Addendum to verify dates it will become unsupported and to notify management to start procedures to upgrade to supported versions of the products before that date. Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(AAMV0014) b) If documented procedures exist to monitor products in the Supported Software Version Release Table in the z/OS STIG Addendum for dates they will become unsupported and to notify management to upgrade to supported versions of the products, there is NO FINDING. c) If documented procedures do not exist to monitor products in the Supported Software Version Release Table in the z/OS STIG Addendum for dates they will become unsupported and to notify management to upgrade to supported versions of the products, this is a FINDING. Note: If product support is provided through an outside group or your site, verify that they have a process to notify site of unsupported software.

Fix text

The IAO/IAM will verify that a process is documented and followed for unsupported software.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer