STIGQter: STIG Summary: zOS FEP for TSS Version: 6 Release: 1 Benchmark Date: 11 Mar 2020:

Procedures are not in place to restrict access to FEP functions of the service subsystem from operator consoles (local and/or remote), and to restrict access to the diskette drive of the service subsystem.

DISA Rule

SV-7196r3_rule

Vulnerability Number

V-6901

Group Title

ZFEP0012

Rule Version

ZFEP0012

Severity

CAT II

CCI(s)

• CCI-000004 - The organization develops procedures to facilitate the implementation of the access control policy and associated access controls.

Weight

10

Fix Recommendation

Ensure that all hardware components of the FEPs are protected as decribed below and supporting documentation procedures exist for each item:

1. Documents and procedures restricting access to the hardware components of the FEPs.

2. Documents and procedures restricting access to the functions of the service subsystem from the control panel.

3. Documents and procedures restricting access to the functions of the service subsystem from the local and/or remote operator consoles (e.g., physical access, password control, key-lock switch of modems, etc.).

4. Documents and procedures restricting access to the diskette drive of the service subsystem.

Check Contents

a) Review site documentation to validate that procedures are in place to protect the FEP service subsystem and diskette drive:

- Documents and procedures restricting access to the functions of the service subsystem from the control panel.
- Documents and procedures restricting access to the functions of the service subsystem from the local and/or remote operator consoles (e.g., physical access, password control, key-lock switch of modems, etc.).
- Documents and procedures restricting access to the diskette drive of the service subsystem.

b) If a procedure is in place to restrict access to the functions of the service subsystem, there is NO FINDING.

c) If a procedure is in place to restrict access to the functions of the service subsystem from operator consoles (local and/or remote), there is NO FINDING.

d) If a procedure is in place to restrict access to the diskette drive of the service subsystem, there is NO FINDING.

e) If no procedure exists for any of the above functions of the service subsystem and FEP resources, this is a FINDING.

Vulnerability Number

V-6901

Documentable

False

Rule Version

ZFEP0012

Severity Override Guidance

a) Review site documentation to validate that procedures are in place to protect the FEP service subsystem and diskette drive:

- Documents and procedures restricting access to the functions of the service subsystem from the control panel.
- Documents and procedures restricting access to the functions of the service subsystem from the local and/or remote operator consoles (e.g., physical access, password control, key-lock switch of modems, etc.).
- Documents and procedures restricting access to the diskette drive of the service subsystem.

b) If a procedure is in place to restrict access to the functions of the service subsystem, there is NO FINDING.

c) If a procedure is in place to restrict access to the functions of the service subsystem from operator consoles (local and/or remote), there is NO FINDING.

d) If a procedure is in place to restrict access to the diskette drive of the service subsystem, there is NO FINDING.

e) If no procedure exists for any of the above functions of the service subsystem and FEP resources, this is a FINDING.

Check Content Reference

M

Responsibility

Information Assurance Officer

Target Key

3359

Comments