STIGQter: STIG Summary: IBM z/OS TSS Security Technical Implementation Guide Version: 8 Release: 2 Benchmark Date: 23 Apr 2021:

IBM z/OS scheduled production batch ACIDs must specify the CA-TSS BATCH Facility, and the Batch Job Scheduler must be authorized to the Scheduled production CA-TSS batch ACID.

DISA Rule

SV-223961r561402_rule

Vulnerability Number

V-223961

Group Title

SRG-OS-000326-GPOS-00126

Rule Version

TSS0-ES-000880

Severity

CAT II

CCI(s)

• CCI-002233 - The information system prevents organization-defined software from executing at higher privilege levels than users executing the software.

Weight

10

Fix Recommendation

Ensure associated ACIDs exist for all batch jobs and documentation justifying access to system resources is maintained and filed with the ISSO. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the required changes.

Check Contents

Refer to the documentation of the processes used for submission of batch jobs via an automated process (i.e., scheduler or other sources) and each of the associated userids.

Ensure that each identified batch ACID is sourced to a specific submission process used only for batch processing.

If the following guidance is true, this is not a finding.

-The job scheduler is cross-authorized to the batch ACIDs.
-The Facility of BATCH is specified for each batch ACID.
-Batch ACIDs with facilities other than BATCH should be questioned to ensure they are truly used for batch processing only, especially if a non-expiring password is used.
-The batch ACIDS may have the NOSUSPEND attribute.

Vulnerability Number

V-223961

Documentable

False

Rule Version

TSS0-ES-000880

Severity Override Guidance

Refer to the documentation of the processes used for submission of batch jobs via an automated process (i.e., scheduler or other sources) and each of the associated userids.

Ensure that each identified batch ACID is sourced to a specific submission process used only for batch processing.

If the following guidance is true, this is not a finding.

-The job scheduler is cross-authorized to the batch ACIDs.
-The Facility of BATCH is specified for each batch ACID.
-Batch ACIDs with facilities other than BATCH should be questioned to ensure they are truly used for batch processing only, especially if a non-expiring password is used.
-The batch ACIDS may have the NOSUSPEND attribute.

Check Content Reference

M

Target Key

4102

Comments