Dynamic lists must be protected in accordance with proper security requirements.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-36	ACP00270	SV-36r7_rule	DCCS-1 DCCS-2 DCSL-1 ECAR-1 ECAR-2 ECAR-3 ECCD-1 ECCD-2	High

Description
Dynamic lists provide a method of making z/OS system changes without interrupting the availability of the operating system. Failure to properly control access to these facilities could result in unauthorized personnel modifying sensitive z/OS lists. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.

STIG	Date
z/OS ACF2 STIG	2016-01-04

Details

Check Text ( C-5438r4_chk )

Refer to the following report produced by the ACF2 Data Collection and Data Set and Resource Data Collection: - SENSITVE.RPT(FACILITY) - ACF2CMDS.RPT(RESOURCE) – Alternate report Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ACP00270) Verify that the accesses for CSV-prefixed resources are properly restricted. If the following guidance is true, this is not a finding. ___ The ACF2 resources and/or generic equivalent are defined with a default access of PREVENT. ___ The ACF2 resources and/or generic equivalent identified below will be defined with LOG and SERVICE(UPDATE) access restricted to system programming personnel: CSVAPF. CSVAPF.MVS.SETPROG.FORMAT.DYNAMIC CSVAPF.MVS.SETPROG.FORMAT.STATIC CSVDYLPA. CSVDYNEX. CSVDYNEX.LIST CSVDYNL. CSVDYNL.UPDATE.LNKLST CSVLLA. ___ The ACF2 CSVDYNEX.LIST resource and/or generic equivalent will be defined with LOG and SERVICE(UPDATE) access restricted to system programming personnel. ___ The ACF2 CSVDYNEX.LIST resource and/or generic equivalent will be defined with SERVICE(READ) access restricted to auditors. ___ If the products CICS and/or CONTROL-O are on the system, the ACF2 access to the CSVLLA resource and/or generic equivalent will be defined with LOG and SERVICE(UPDATE) access restricted to the CICS and CONTROL-O STC logonids. ___ If the products BMC Mainview, CA 1, and/or CA Common Services are on the system, the ACF2 access to the CSVDYLPA resource and/or generic equivalent will be defined with LOG and SERVICE(UPDATE) access restricted to BMC Mainview, CA 1, and CA Common Services STC logonids. Note: In the above, SERVICE(UPDATE) can be substituted with ADD, CONTROL, or LOG/ALLOW. Review the rules definitions in the ACF2 documentation when specifying SERVICE(UPDATE).

Fix Text (F-35197r4_fix)

Ensure that the Dynamic List resources are defined to the IBMFAC resource class and protected. Only system programmers and a limited number of authorized users and Started Tasks are able to issue these commands. All access is logged. (Note: The resource class, resources, and/or resource prefixes identified below are examples of a possible installation. The resource class, actual resources, and/or prefixes are determined when the product is actually installed on a system through the product’s installation guide and can be site specific.) The required CSV-prefixed Facility Class resources are listed below. These resources and/or generic equivalents should be defined and permitted as required with only z/OS systems programmers and logging enabled. Minimum required list of CSV-prefixed resources: CSVAPF.- CSVAPF.MVS.SETPROG.FORMAT.DYNAMIC CSVAPF.MVS.SETPROG.FORMAT.STATIC CSVDYLPA.- CSVDYLPA.ADD.- CSVDYLPA.DELETE.- CSVDYNEX.- CSVDYNEX.LIST CSVDYNL.- CSVDYNL.UPDATE.LNKLST CSVLLA.- Limit authority to those resources to z/OS systems programmers. Restrict to the absolute minimum number of personnel with LOG and SERVICE(UPDATE) access. Sample commands are shown here to accomplish one set of resources: $KEY(CSVAPF) TYPE(FAC) MVS.SETPROG.- UID(syspaudt) LOG MVS.SETPROG.FORMAT.DYNAMIC.- UID(syspaudt) LOG MVS.SETPROG.FORMAT.STATIC.- UID(syspaudt) LOG MVS.SETPROG.FORMAT.- UID(syspaudt) LOG MVS.SETPROG.FORMAT.- UID(*) PREVENT - UID(syspaudt) LOG - UID(*) PREVENT SET R(FAC) COMPILE 'ACF2.xxxx.FAC(CSVAPF)' STORE F ACF2,REBUILD(FAC) The CSVDYLPA.ADD resource can be permitted to BMC Mainview, CA 1, and CA Common Services STC logonids with LOG and SERVICE(UPDATE) access. The CSVDYLPA.DELETE resource can be permitted to CA 1 and CA Common Services STC logonids with LOG and SERVICE(UPDATE) access. Sample commands are shown here to accomplish one set of resources: $KEY(CSVDYLPA) TYPE(FAC) ADD.- UID(syspaudt) LOG SERVICE(UPDATE) ADD.- UID(BMC Mainview STC) LOG SERVICE(UPDATE) ADD.- UID(CA 1 STC) LOG SERVICE(UPDATE) ADD.- UID(CCS STC) LOG SERVICE(UPDATE) DELETE.- UID(syspaudt) LOG SERVICE(UPDATE) DELETE.- UID(CA 1 STC) LOG SERVICE(UPDATE) DELETE.- UID(CCS STC) LOG SERVICE(UPDATE) - UID(syspaudt) LOG - UID(*) PREVENT SET R(FAC) COMPILE 'ACF2.xxxx.FAC(CSVDYLPA)' STORE F ACF2,REBUILD(FAC) The CSVDYNEX.LIST resource and/or generic equivalent will be defined with LOG and SERVICE(UPDATE) access restricted to system programming personnel. The CSVDYNEX.LIST resource and/or generic equivalent will be defined with SERVICE(READ) access with ALLOW restricted to auditors. Sample commands are shown here to accomplish this: $KEY(CSVDYNEX) TYPE(FAC) LIST.- UID(syspaudt) LOG LIST.- UID(audtaudt) SERVICE(READ) ALLOW - UID(syspaudt) LOG - UID(*) PREVENT SET R(FAC) COMPILE 'ACF2.xxxx.FAC(CSVDYNEX)' STORE F ACF2,REBUILD(FAC) The CSVLLA resource can be permitted to CICS and CONTROL-O STC logonids with LOG and SERVICE(UPDATE) access. Sample commands are shown here to accomplish one set of resources: $KEY(CSVLLA) TYPE(FAC) - UID(syspaudt) LOG - UID(CICS STC logonids) LOG SERVICE(UPDATE) - UID(CONTROL-O STC logonid) LOG SERVICE(UPDATE) - UID(*) PREVENT SET R(FAC) COMPILE 'ACF2.xxxx.FAC(CSVLLA)' STORE F ACF2,REBUILD(FAC)