Update and allocate access to ACP files and/or databases are not limited to system programmers and/or security personnel.

From z/OS RACF STIG

Part of ACP00120

Associated with IA controls: DCCS-1, ECCD-2, DCCS-2, ECAR-3, ECAR-2, ECCD-1, ECAR-1

SV-118r1_rule Update and allocate access to ACP files and/or databases are not limited to system programmers and/or security personnel.

Vulnerability discussion

The ACP database files contain all access control information for the operating system environment and system resources. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.

Check content

a) Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(ACPRPT) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ACP00120) ___ The ACP data set rules for ACP security files allow inappropriate access. ___ The ACP data set rules for ACP security files do not restrict READ, UPDATE, and/or ALTER access to z/OS systems programming personnel, security personnel, and/or batch jobs that perform ACP maintenance. ___ All (i.e., failures and successes) data set access authorities (i.e., READ, UPDATE, ALTER, and CONTROL) for ACP security files are not logged. b) If all of the above are untrue, there is NO FINDING. c) If any of the above is true, this is a FINDING.

Fix text

Review access authorization to critical security database files. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the changes required to protect the ACP Files. The IAO will ensure that update and alter access to all ACP files and/or databases are limited to system programmers and/or security personnel, and/or batch jobs that perform ACP maintenance. and all access is logged.

Pro Tips

Powered by sagemincer