CICS userids are not defined and/or controlled in accordance with proper security requirements.

Associated with IA controls: DCCS-1, ECCD-2, DCCS-2, ECCD-1

SV-7525r1_rule CICS userids are not defined and/or controlled in accordance with proper security requirements.

Vulnerability discussion

CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.

Check content

a) Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(WHOOPROP) Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. b) Ensure the CICS region is defined to the PROPCNTL resource class. c) If (b) are true, there is NO FINDING. d) If (b) is untrue, this is a FINDING.

Fix text

Ensure the CICS region is defined to the PROPCNTL resource class. Example: TSS ADDTO(owning acid) PROPCNTL(CICS region acid)

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.