From z/OS TSS STIG
Part of TSS1030
Associated with IA controls: DCCS-1, DCCS-2
Access authorization to data sets is verified by examining both volume access and data set access authorization. If a user has been authorized for any volume access greater than CREATE, then TSS allows access to the volume without checking the data set authorizations. A user could potentially alter a data set that resides on a volume even though access has not been granted to that data set.
a) Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(WHOHVOL) b) Determine whether or not access authorization greater than CREATE (e.g. CONTROL or ALL) has been granted for volumes. c) If access authorizations for volumes are within the requirements, there is NO FINDING. d) If access authorization for volumes exceeds the requirements without justification, this is a FINDING. NOTE: Domain level DASD Administrators who are responsible for the Domain level DASD/storage administration. Volume level access to those team members who are directly responsible and perform Domain level DASD/Storage administration may be granted access to all volumes via PRIVPGM controls.
The IAO will ensure that VOLUME access authorization greater than CREATE is not permitted unless authorized by the IAO. Review all access to VOLUMEs. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the required changes. *Noted Exception: Domain level DASD Administrators who are responsible for the Domain level DASD/storage administration. Volume level access to those team members who are directly responsible and perform Domain level DASD/Storage administration may be granted access to all volumes via PRIVPGM controls. Domain Level DASD/Storage administrators access should be granted VOL(*ALL*)ACC(ALL)ACTION(AUDIT)PRIVPGM(list of privileged programs)
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer