STIGQter: STIG Summary: z/OS IBM CICS Transaction Server for RACF STIG Version: 6 Release: 6 Benchmark Date: 24 Apr 2020:

CICS regions are improperly protected to prevent unauthorized propagation of the region userid.

DISA Rule

SV-7193r3_rule

Vulnerability Number

V-6898

Group Title

ZCICR041

Rule Version

ZCICR041

Severity

CAT II

CCI(s)

• CCI-000213 - The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Utilize propagation control for each CICS region.

Under no circumstance should a user's batch job submitted from a CICS region execute under that CICS region's userid. To prevent this from occurring, define a profile in the PROPCNTL resource class for each CICS region. The
following is an example:
RDEFINE PROPCNTL <cics-region-userid> OWNER(ADMIN) AUDIT(ALL(READ))

The PROPCNTL class must be active and RACLISTed for this protection to be in effect:
SETROPTS CLASSACT(PROPCNTL) RACLIST(PROPCNTL)

Check Contents

a) Refer to the following report produced by the RACF Data Collection:

- SENSITVE.RPT(PROPCNTL)

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

b) Ensure the CICS region is defined to the PROPCNTL resource class.

c) If (b) are true, there is NO FINDING.

d) If (b) is untrue, this is a FINDING.

Vulnerability Number

V-6898

Documentable

False

Rule Version

ZCICR041

Severity Override Guidance

a) Refer to the following report produced by the RACF Data Collection:

- SENSITVE.RPT(PROPCNTL)

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

b) Ensure the CICS region is defined to the PROPCNTL resource class.

c) If (b) are true, there is NO FINDING.

d) If (b) is untrue, this is a FINDING.

Check Content Reference

M

Responsibility

Information Assurance Officer

Target Key

197

Comments