STIGQter STIGQter: STIG Summary: z/OS IBM CICS Transaction Server for RACF STIG Version: 6 Release: 6 Benchmark Date: 24 Apr 2020:

CICS default logonid(s) must be defined and/or controlled in accordance with the security requirements.

DISA Rule

SV-7536r4_rule

Vulnerability Number

V-7119

Group Title

ZCIC0041

Rule Version

ZCIC0041

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Ensure the following items are in effect for the CICS default userid (i.e., DFLTUSER=default userid):

1) Not granted the RACF OPERATIONS attribute.

a) Issue a RACF LU (Listuser) command on the CICS default userid.

b) The OPERATIONS attribute can be removed via the RACF command ALU <cicsdefaultuser> NOOPERATIONS

2) No access to interactive on-line facilities (e.g., TSO) other than CICS.

a) Use the RACF ALU (Altuser) command to remove attributes such as TSO. Example: ALU <cicsdefaultuser> NOTSO

3) TIMEOUT parameter in the CICS segment is set to 15 minutes.

4) A system's default time for terminal lock-out or session termination may be lengthened to 30 minutes at the discretion of the IAM. The IAM will maintain the documentation for each system with a time-out adjusted beyond the 15-minute recommendation to explain the basis for this decision.

a) Use the RACF LU (ListUser) command to display the CICS segment. An example is shown here:
LU <cicsdefaultuser> CICS

b) Use the RACF ALU command to set the 15 minute timeout value. An example is shown here:
ALU <cicsdefaultuser> CICS(TIMEOUT(15))

5) Restricted from accessing all data sets and resources with the following exceptions:

a) Delete the CICS default user from dataset access lists via the command:
PE '<dataset profile name>' ID(<cicsdefaultuser>) DEL

(a) Non-restricted CICS transactions (e.g., CESF, CESN, ‘good morning’ transaction, etc.)

(b) If applicable, resources necessary to operate in an intersystem communication (ISC) environment (i.e., LU6.1, LU6.2, and MRO)

NOTE: Execute the JCL in CNTL(IRRUT100) using the CICS default userid as SYSIN input. This report lists all occurrences of this userid within the RACF database, including data set and resource access lists.

c) If all items in (b) are true, there is NO FINDING.

d) If any item in (b) is untrue, this is a FINDING.

Check Contents

a) Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC)

Refer to the following reports produced by the RACF Data Collection:

- RACFCMDS.RPT(LISTUSER)
- SENSITVE.RPT(TCICSTRN)
- SENSITVE.RPT(GCICSTRN)

NOTE: If a CICS region is using a site-defined transaction resource class pair, execute a RACF RLIST command against these resource classes.

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

b) Ensure the following items are in effect for the CICS default userid (i.e., DFLTUSER=default userid):

1) Not granted the RACF OPERATIONS attribute.
2) No access to interactive on-line facilities (e.g., TSO) other than CICS.
3) TIMEOUT parameter in the CICS segment is set to 15 minutes.

4) A system's default time for terminal lock-out or session termination may be lengthened to 30 minutes at the discretion of the IAM. The IAM will maintain the documentation for each system with a time-out adjusted beyond the 15-minute recommendation to explain the basis for this decision.

5) Restricted from accessing all data sets and resources with the following exceptions:

(a) Non-restricted CICS transactions (e.g., CESF, CESN, ‘good morning’ transaction, etc.)
(b) If applicable, resources necessary to operate in an intersystem communication (ISC) environment (i.e., LU6.1, LU6.2, and MRO)

NOTE: Execute the JCL in CNTL(IRRUT100) using the CICS default userid as SYSIN input. This report lists all occurrences of this userid within the RACF database, including data set and resource access lists.

c) If all items in (b) are true, this not a finding.

d) If any item in (b) is untrue, this is a finding.

Vulnerability Number

V-7119

Documentable

True

Rule Version

ZCIC0041

Severity Override Guidance

a) Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC)

Refer to the following reports produced by the RACF Data Collection:

- RACFCMDS.RPT(LISTUSER)
- SENSITVE.RPT(TCICSTRN)
- SENSITVE.RPT(GCICSTRN)

NOTE: If a CICS region is using a site-defined transaction resource class pair, execute a RACF RLIST command against these resource classes.

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

b) Ensure the following items are in effect for the CICS default userid (i.e., DFLTUSER=default userid):

1) Not granted the RACF OPERATIONS attribute.
2) No access to interactive on-line facilities (e.g., TSO) other than CICS.
3) TIMEOUT parameter in the CICS segment is set to 15 minutes.

4) A system's default time for terminal lock-out or session termination may be lengthened to 30 minutes at the discretion of the IAM. The IAM will maintain the documentation for each system with a time-out adjusted beyond the 15-minute recommendation to explain the basis for this decision.

5) Restricted from accessing all data sets and resources with the following exceptions:

(a) Non-restricted CICS transactions (e.g., CESF, CESN, ‘good morning’ transaction, etc.)
(b) If applicable, resources necessary to operate in an intersystem communication (ISC) environment (i.e., LU6.1, LU6.2, and MRO)

NOTE: Execute the JCL in CNTL(IRRUT100) using the CICS default userid as SYSIN input. This report lists all occurrences of this userid within the RACF database, including data set and resource access lists.

c) If all items in (b) are true, this not a finding.

d) If any item in (b) is untrue, this is a finding.

Check Content Reference

M

Responsibility

Information Assurance Officer

Target Key

197

Comments