CICS default logonid(s) are not defined and/or controlled in accordance with the security requirements.

From z/OS TSS STIG

Part of ZCIC0041

Associated with IA controls: DCCS-1, ECCD-2, DCCS-2, ECCD-1

SV-7537r1_rule CICS default logonid(s) are not defined and/or controlled in accordance with the security requirements.

Vulnerability discussion

CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.

Check content

Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(CICSPROC) Refer to the following report produced by the TSS Data Collection and Data Set and Resource Data Collection: - TSSCMDS.RPT(@ACIDS) - SENSITVE.RPT(WHOHOTRA) Refer to the information gathered from the CICS Systems Programmer’s Worksheet filled out from previous vulnerability ZCIC0010. Ensure the following items are in effect for the CICS default ACID (i.e., DFLTUSER=default userid): 1) Not granted the TSS BYPASS privilege. 2) No access to interactive on-line facilities (e.g., TSO) other than CICS. 3) OPTIME parameter is set to 15 minutes. 4) A system's default time for terminal lock-out or session termination may be lengthened to 30 minutes at the discretion of the IAM. The IAM will maintain the documentation for each system with a time-out adjusted beyond the 15-minute recommendation to explain the basis for this decision. 5) Restricted from accessing all data sets and resources with the following exceptions: (a) Non-restricted CICS transactions (e.g., CESF, CESN, ‘good morning’ transaction, etc.). (b) If applicable, resources necessary to operate in an intersystem communication (ISC) environment (i.e., LU6.1, LU6.2, and MRO).

Fix text

Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required. Ensure the following items are in effect for the CICS default ACID (i.e., DFLTUSER=default userid): 1) Not granted the TSS BYPASS privilege. 2) No access to interactive on-line facilities (e.g., TSO) other than CICS. 3) OPTIME parameter is set to 15 minutes. can be increased up to 30 if justified by the IAM. 4) Restricted from accessing all data sets and resources with the following exceptions: (a) Non-restricted CICS transactions (e.g., CESF, CESN, ‘good morning’ transaction, etc.). (b) If applicable, resources necessary to operate in an intersystem communication (ISC) environment (i.e., LU6.1, LU6.2, and MRO).

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer