LOGONIDs with the ACCOUNT, LEADER, or SECURITY attribute must be properly scoped.

From z/OS ACF2 STIG

Part of ACF0750

Associated with IA controls: DCCS-1, DCCS-2

Associated with: CCI-002227 CCI-002276

SV-171r2_rule LOGONIDs with the ACCOUNT, LEADER, or SECURITY attribute must be properly scoped.

Vulnerability discussion

Individuals with these powerful attributes may have more extensive privileges than necessary to perform their job function. There could be no separation of duties and/or principle of least privilege in effect. This could result in the compromise of the confidentiality, integrity, and availability of the operating system, ACP, or customer data.

Check content

Refer to the following reports produced by the ACF2 Data Collection: - ACF2CMDS.RPT(ATTACCT) - ACF2CMDS.RPT(ATTLEAD) - ACF2CMDS.RPT(ATTSECT) Automated Analysis Refer to the following report produced by the ACF2 Data Collection: - PDI(ACF0750) Review all logonids for specific groups with the attributes ACCOUNT, LEADER, or SECURITY ensure they have the SCPLIST attribute specified properly according to job function and areas of responsibility. NOTE: SCPLST attributes are not required for Domain Level Security Admin Logonids and BATCH Logonids that administer and modify the entire ACF2 environment to include GSO records, data set and resource rules, etc. or run audit reports.

Fix text

The IAO will ensure logonids with the ACCOUNT, LEADER, and SECURITY attributes are restricted by a SCPLIST attribute that restricts authority based on job function and area of responsibility. The following user attributes allow update of the ACF2 databases for administering users, data set access rules, and Infostorage records. When granted to a logonid, restrict the scope of the following attributes using an associated SCPLIST (scope list) record: ACCOUNT LEADER SECURITY NOTE: SCPLST attributes are not required for Domain Level Security Admin Logonids and BATCH Logonids that administer and modify the entire ACF2 environment to include GSO records, data set and resource rules, etc. or run audit reports.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer