Procedures are not in place to restrict access to FEP functions of the service subsystem from operator consoles (local and/or remote), and to restrict access to the diskette drive of the service subsystem.

From z/OS TSS STIG

Part of ZFEP0012

Associated with IA controls: DCCS-1, DCCS-2

Associated with: CCI-000004

SV-7196r2_rule Procedures are not in place to restrict access to FEP functions of the service subsystem from operator consoles (local and/or remote), and to restrict access to the diskette drive of the service subsystem.

Vulnerability discussion

If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, the operator console, and the diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations.

Check content

a) Review site documentation to validate that procedures are in place to protect the FEP service subsystem and diskette drive: - Documents and procedures restricting access to the functions of the service subsystem from the control panel. - Documents and procedures restricting access to the functions of the service subsystem from the local and/or remote operator consoles (e.g., physical access, password control, key-lock switch of modems, etc.). - Documents and procedures restricting access to the diskette drive of the service subsystem. b) If a procedure is in place to restrict access to the functions of the service subsystem, there is NO FINDING. c) If a procedure is in place to restrict access to the functions of the service subsystem from operator consoles (local and/or remote), there is NO FINDING. d) If a procedure is in place to restrict access to the diskette drive of the service subsystem, there is NO FINDING. e) If no procedure exists for any of the above functions of the service subsystem and FEP resources, this is a FINDING.

Fix text

Ensure that all hardware components of the FEPs are protected as decribed below and supporting documentation procedures exist for each item: 1. Documents and procedures restricting access to the hardware components of the FEPs. 2. Documents and procedures restricting access to the functions of the service subsystem from the control panel. 3. Documents and procedures restricting access to the functions of the service subsystem from the local and/or remote operator consoles (e.g., physical access, password control, key-lock switch of modems, etc.). 4. Documents and procedures restricting access to the diskette drive of the service subsystem.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer