STIGQter: STIG Summary: IBM z/OS ACF2 Security Technical Implementation Guide Version: 8 Release: 2 Benchmark Date: 23 Apr 2021:

IBM z/OS JESNEWS resources must be protected in accordance with security requirements.

DISA Rule

SV-223530r533198_rule

Vulnerability Number

V-223530

Group Title

SRG-OS-000080-GPOS-00048

Rule Version

ACF2-JS-000030

Severity

CAT II

CCI(s)

• CCI-000213 - The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Configure the resource rules for the OPERCMDS resource class (i.e., TYPE(OPR)) and ensure the following items are in effect:

1) The JES2.UPDATE.JESNEWS resource is defined to the OPERCMDS resource class with a default access of PREVENT.

2) Access authorization to the JES2.UPDATE.JESNEWS resource in the OPERCMDS class restricts DELETE service to the appropriate personnel (i.e., users responsible for maintaining the JES News data set) and all access is logged.

Example:
$KEY(JES2) TYPE(OPR)
UPDATE.JESNEWS UID(SYSPROG) SERVICE(READ,UPDATE) LOG
UPDATE.JESNEWS UID(*) PREVENT

Check Contents

From the ACF command screen enter:
SET RESOURCE(OPR)
LIST LIKE(JES-)

If the JES2.UPDATE.JESNEWS resource is defined to the OPERCMDS resource class with a default access of PREVENT, this is not a finding.

NOTE: JES2 is typically the name of the JES2 subsystem. Refer to the SUBSYS report and locate the entry with the description of PRIMARY JOB ENTRY SUBSYSTEM. The SUBSYSTEM NAME of this entry is the name of the JES2 subsystem.

If access authorization to the JES2.UPDATE.JESNEWS resource in the OPERCMDS class restricts DELETE service to the appropriate personnel (i.e., users responsible for maintaining the JES News data set) and all access is logged, this is not a finding.

Vulnerability Number

V-223530

Documentable

False

Rule Version

ACF2-JS-000030

Severity Override Guidance

From the ACF command screen enter:
SET RESOURCE(OPR)
LIST LIKE(JES-)

If the JES2.UPDATE.JESNEWS resource is defined to the OPERCMDS resource class with a default access of PREVENT, this is not a finding.

NOTE: JES2 is typically the name of the JES2 subsystem. Refer to the SUBSYS report and locate the entry with the description of PRIMARY JOB ENTRY SUBSYSTEM. The SUBSYSTEM NAME of this entry is the name of the JES2 subsystem.

If access authorization to the JES2.UPDATE.JESNEWS resource in the OPERCMDS class restricts DELETE service to the appropriate personnel (i.e., users responsible for maintaining the JES News data set) and all access is logged, this is not a finding.

Check Content Reference

M

Target Key

4100

Comments