From z/OS TSS STIG
Part of ACP00282
Associated with IA controls: DCCS-1, ECCD-2, DCCS-2, ECAR-2, ECCD-1, ECAR-1
z/OS system commands provide a method of controlling the operating environment. Failure to properly control access to z/OS system commands could result in unauthorized personnel issuing sensitive system commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.
a) Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(WHOHOPER) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ACP00282) b) If the access to MVS resource of the OPERCMDS class is restricted to a limited number of authorized users, and all access logged. c) If access to z/OS system commands as defined in the table entitled Required Controls on z/OS System Commands, in the z/OS STIG Addendum, is restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users). NOTE: Use the GROUP category specified in the table referenced above as a guideline to determine appropriate personnel access to system commands. NOTE: The (MVS.SEND) Command will not be a finding if used by all. d) If access to specific z/OS system commands is logged as indicated in the table entitled Required Controls on z/OS System Commands, in the z/OS STIG Addendum. e) If either (b), (c), or (d) above is untrue for any z/OS system command resource, this is a FINDING. f) If (b), (c), and (d) above are true, there is NO FINDING.
Ensure access to the MVS resource of the OPERCMDS class is restricted to a limited number of authorized users, and all access is logged. Ensure access to z/OS system commands as defined in the table entitled Required Controls on z/OS System Commands, in the z/OS STIG Addendum is restricted to the appropriate personnel (e.g., operations staff, systems programming personnel, general users). NOTE: Use the GROUP category specified in the table referenced above as a guideline to determine appropriate personnel access to system commands. NOTE: The (MVS.SEND) Command will not be a finding if used by all. Example: TSS ADDTO(deptacid) OPERCMDS(MVS.) TSS PERMIT(usracid) OPERCMDS(MVS.ACTIVATE) ACTION(AUDIT) TSS PERMIT(usracid) OPERCMDS(MVS.CANCEL.JOB.) ACTION(AUDIT) TSS PERMIT(usracid) OPERCMDS(MVS.CONTROL.) ACCESS(UPDATE) ACTION(AUDIT) TSS PERMIT(usracid) OPERCMDS(MVS.DISPLAY.) ACCESS(READ) TSS PERMIT(usracid) OPERCMDS(MVS.MONITOR) ACCESS(READ) TSS PERMIT(usracid) OPERCMDS(MVS.STOPMN) ACCESS(READ)
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer