Dynamic lists must be protected in accordance with proper security requirements.

From z/OS RACF STIG

Part of ACP00270

Associated with IA controls: DCCS-1, ECCD-2, DCCS-2, ECAR-3, ECAR-2, ECCD-1, ECAR-1, DCSL-1

SV-6409r4_rule Dynamic lists must be protected in accordance with proper security requirements.

Vulnerability discussion

Dynamic lists provide a method of making z/OS system changes without interrupting the availability of the operating system. Failure to properly control access to these facilities could result in unauthorized personnel modifying sensitive z/OS lists. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.

Check content

Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(FACILITY) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ACP00270) Verify that the accesses for CSV-prefixed resources are properly restricted. If the following guidance is true, this is not a finding. ___ The RACF resources and/or generic equivalent are defined with a default access of NONE. ___ The RACF resources and/or generic equivalent identified below will be defined with AUDIT(ALL(READ)) and UPDATE access restricted to system programming personnel: CSVAPF. CSVAPF.MVS.SETPROG.FORMAT.DYNAMIC CSVAPF.MVS.SETPROG.FORMAT.STATIC CSVDYLPA. CSVDYNEX. CSVDYNEX.LIST CSVDYNL. CSVDYNL.UPDATE.LNKLST CSVLLA. ___ The RACF CSVDYNEX.LIST resource and/or generic equivalent will be defined with AUDIT(FAILURE(READ)SUCCESS(UPDATE)) and UPDATE access restricted to system programming personnel. ___ The RACF CSVDYNEX.LIST resource and/or generic equivalent will be defined with READ access restricted to auditors. ___ If the products CICS and/or Control-O are on the system, the RACF access to the CSVLLA resource and/or generic equivalent will be defined with AUDIT(ALL) and UPDATE access restricted to the CICS and Control-O ACIDs. ___ If the product CA 1 and/or CA Common Services is on the system, the RACF access to the CSVDYLPA resource and/or generic equivalent will be defined with AUDIT(ALL) and UPDATE access restricted to the CA 1 and/or CA Common Services userids. Note: In the above, UPDATE access can be substituted with ALTER or CONTROL. Review the permissions in the IBM documentation when specifying UPDATE.

Fix text

The IAO working with the system programmer will ensure that the Dynamic List resources are defined to the IBMFAC resource class and protected. Only system programmers and a limited number of authorized users and Started Tasks are able to issue these commands. All access is logged. (Note: The resource class, resources, and/or resource prefixes identified below are examples of a possible installation. The resource class, actual resources, and/or prefixes are determined when the product is actually installed on a system through the product’s installation guide and can be site specific.) The required CSV-prefixed Facility Class resources are listed below. These resources or generic equivalents should be defined and permitted as required with only z/OS systems programmers and logging enabled. Minimum required list of CSV-prefixed resources: CSVAPF.** CSVAPF.MVS.SETPROG.FORMAT.DYNAMIC CSVAPF.MVS.SETPROG.FORMAT.STATIC CSVDYLPA.** CSVDYNEX.** CSVDYNEX.LIST CSVDYNL.** CSVDYNL.UPDATE.LNKLST CSVLLA.** Limit authority to those resources to z/OS systems programmers. Restrict to the absolute minimum number of personnel with AUDIT(ALL(READ)) and UPDATE access. Sample commands are shown here to accomplish this: RDEF FACILITY CSVAPF.** UACC(NONE) OWNER(syspaudt) AUDIT(ALL(READ)) RDEF FACILITY CSVAPF.MVS.SETPROG.** UACC(NONE) OWNER(syspaudt) AUDIT(ALL(READ)) RDEF FACILITY CSVAPF.MVS.SETPROG.FORMAT.** UACC(NONE) OWNER(syspaudt) AUDIT(ALL(READ)) RDEF FACILITY CSVAPF.MVS.SETPROG.FORMAT.DYNAMIC.** UACC(NONE) OWNER(syspaudt) AUDIT(ALL(READ)) RDEF FACILITY CSVAPF.MVS.SETPROG.FORMAT.STATIC.** UACC(NONE) OWNER(syspaudt) AUDIT(ALL(READ)) PERMIT CSVAPF.** CLASS(FACILITY) ID(syspaudt) ACCESS(UPDATE) PERMIT CSVAPF.MVS.SETPROG.** CLASS(FACILITY) ID(syspaudt) ACCESS(UPDATE) PERMIT CSVAPF.MVS.SETPROG.FORMAT.** CLASS(FACILITY) ID(syspaudt) ACCESS(UPDATE) PERMIT CSVAPF.MVS.SETPROG.SETPROG.FORMAT.DYNAMIC.** CLASS(FACILITY) ID(syspaudt) ACCESS(UPDATE) PERMIT CSVAPF.MVS.SETPROG.SETPROG.FORMAT.STATIC.** CLASS(FACILITY) ID(syspaudt) ACCESS(UPDATE) The CSVLLA resource will be permitted to systems programmers, CICS, and Control-O userids with AUDIT(ALL(READ)) and UPDATE access. Sample commands are shown here to accomplish one set of resources: RDEF FACILITY CSVLLA.** UACC(NONE) OWNER(syspaudt) AUDIT(ALL(READ)) PERMIT CSVLLA.** CLASS(FACILITY) ID(syspaudt) ACCESS(UPDATE) PERMIT CSVLLA.** CLASS(FACILITY) ID(CICS userid) ACCESS(UPDATE) PERMIT CSVLLA.** CLASS(FACILITY) ID(Control-O userid) ACCESS(UPDATE) The CSVDYLPA resource will be permitted to CA 1 and/or CA Common Services userids with AUDIT(ALL(READ)) and UPDATE access. Sample commands are shown here to accomplish one set of resources: RDEF FACILITY CSVDYLPA.** UACC(NONE) OWNER(syspaudt) AUDIT(ALL(READ)) PERMIT CSVDYLPA.** CLASS(FACILITY) ID(syspaudt) ACCESS(UPDATE) PERMIT CSVDYLPA.** CLASS(FACILITY) ID(CA 1 STC userid) ACCESS(UPDATE) PERMIT CSVDYLPA.** CLASS(FACILITY) ID(CCS STC userid) ACCESS(UPDATE) The CSVDYNEX.LIST resource and/or generic equivalent will be defined with AUDIT(FAILURE(READ)SUCCESS(UPDATE)) and UPDATE access restricted to system programming personnel. The CSVDYNEX.LIST resource and/or generic equivalent will be defined with READ access restricted to auditors. Sample commands are shown here to accomplish this: RDEF FACILITY CSVDYNEX.LIST.** UACC(NONE) OWNER(syspaudt) – AUDIT(FAILURE(READ)SUCCESS(UPDATE)) PERMIT CSVDYNEX.LIST.** CLASS(FACILITY) ID(syspaudt) ACCESS(UPDATE) PERMIT CSVDYNEX.LIST.** CLASS(FACILITY) ID(audtaudt) ACCESS(READ)

Pro Tips

Powered by sagemincer