STIGQter: STIG Summary: IBM z/OS TSS Security Technical Implementation Guide Version: 8 Release: 2 Benchmark Date: 23 Apr 2021:

CA-TSS must limit Write or greater access to SYS1.UADS to system programmers only, and Read and Update access must be limited to system programmer personnel and/or security personnel.

DISA Rule

SV-223908r561402_rule

Vulnerability Number

V-223908

Group Title

SRG-OS-000080-GPOS-00048

Rule Version

TSS0-ES-000350

Severity

CAT I

CCI(s)

• CCI-000213 - The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
• CCI-002235 - The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

Weight

10

Fix Recommendation

Evaluate the impact of correcting any deficiency. Develop a plan of action and implement the changes as required to protect SYS1.UADS.
SYS1.UADS WRITE or Greater authority is limited to the systems programming staff.

Read and update access should be limited to the security staff.

READ access is limited to Auditors when included in the site security plan

Configure allocate access to SYS1.UADS to be limited to system programmers only, read and update access to SYS1.UADS to be limited to system programmer personnel and/or security personnel and all data set access is logged.

Check Contents

The ESM data set rules for SYS1.UADS restricts WRITE or Greater access to only z/OS systems programming personnel.

The ESM data set rules for SYS1.UADS restricts READ and/or UPDATE access to z/OS systems programming personnel and/or security personnel.

The ESM data set rules for SYS1.UADS specifies that all (i.e., failures and successes) data set access authorities (i.e., READ, UPDATE, ALTER, and CONTROL) will be logged.

The ESM data set rules for SYS1.UADS restricts READ access to auditors as documented in Security Plan.

If all of the above are untrue, this is not a finding.

If any of the above is true, this is a finding.

Vulnerability Number

V-223908

Documentable

False

Rule Version

TSS0-ES-000350

Severity Override Guidance

The ESM data set rules for SYS1.UADS restricts WRITE or Greater access to only z/OS systems programming personnel.

The ESM data set rules for SYS1.UADS restricts READ and/or UPDATE access to z/OS systems programming personnel and/or security personnel.

The ESM data set rules for SYS1.UADS specifies that all (i.e., failures and successes) data set access authorities (i.e., READ, UPDATE, ALTER, and CONTROL) will be logged.

The ESM data set rules for SYS1.UADS restricts READ access to auditors as documented in Security Plan.

If all of the above are untrue, this is not a finding.

If any of the above is true, this is a finding.

Check Content Reference

M

Target Key

4102

Comments