STIGQter: STIG Summary: z/OS IBM CICS Transaction Server for ACF2 STIG Version: 6 Release: 6 Benchmark Date: 24 Apr 2020:

CICS region logonid(s) must be defined and/or controlled in accordance with the security requirements.

DISA Rule

SV-44r4_rule

Vulnerability Number

V-44

Group Title

ZCIC0040

Rule Version

ZCIC0040

Severity

CAT II

CCI(s)

• CCI-000764 - The information system uniquely identifies and authenticates organizational users (or processes acting on behalf of organizational users).

Weight

10

Fix Recommendation

The IAO will ensure that each CICS region is associated with a unique userid and that userid is properly defined.

Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required.

Ensure that the following is defined for each CICS region:

1) A unique userid is defined.

Use the ACF2 insert command to accomplish this. A sample command is provided here:

INSERT <cicsregionid> NAME('STC, CICS Region') JOBFROM MUSASS NO-SMC STC ACF2CICS

Check Contents

a) Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC)

Refer to the following report produced by the ACF2 Data Collection:

- ACF2CMDS.RPT(LOGONIDS)

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

b) Ensure the following items are in effect for each CICS region logonid:

1) A unique logonid is associated with the CICS region.
2) The CICS region logonid has the ACF2CICS, MUSASS, and NO-SMC attributes specified.
NOTE: The ACF2CICS privilege will be restricted to CICS region logonids only.
3) If CICS region submits jobs on behalf of its users, the JOBFROM attribute is specified.
4) If CICS region has a requirement to update information in the ACF2 database, the MUSUPDT attribute is specified.
5) Not granted the ACF2 NON-CNCL privilege.
6) No access to interactive on-line facilities (e.g., TSO) other than CICS.

c) If (b) are true, this is not a finding.

d) If (b) is untrue, this is a finding.

Vulnerability Number

V-44

Documentable

False

Rule Version

ZCIC0040

Severity Override Guidance

a) Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC)

Refer to the following report produced by the ACF2 Data Collection:

- ACF2CMDS.RPT(LOGONIDS)

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

b) Ensure the following items are in effect for each CICS region logonid:

1) A unique logonid is associated with the CICS region.
2) The CICS region logonid has the ACF2CICS, MUSASS, and NO-SMC attributes specified.
NOTE: The ACF2CICS privilege will be restricted to CICS region logonids only.
3) If CICS region submits jobs on behalf of its users, the JOBFROM attribute is specified.
4) If CICS region has a requirement to update information in the ACF2 database, the MUSUPDT attribute is specified.
5) Not granted the ACF2 NON-CNCL privilege.
6) No access to interactive on-line facilities (e.g., TSO) other than CICS.

c) If (b) are true, this is not a finding.

d) If (b) is untrue, this is a finding.

Check Content Reference

M

Responsibility

Information Assurance Officer

Target Key

198

Comments