OpenControls Logo

STIG Viewer

STIGViewer Support

IDMS must protect its user catalogs and system dictionaries to prevent unauthorized users from bypassing or updating security settings.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-251638IDMS-DB-000670SV-251638r961353_ruleCCI-002235medium
Description
Unauthorized access to user profiles, dictionaries, and user catalogs provides the ability to damage the IDMS system.
STIGDate
CA IDMS Security Technical Implementation Guide2024-09-13

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-21.5Prohibit Non-Privileged Users from Executing Privileged Functions
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (50) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(4)Discretionary Access Control
1.00
AC-3(7)Role-based Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00

+40 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.7
1.00
CCI1 mapping
CCI-002235
1.00

Details

Check Text (C-251638r961353_chk)

Examine load module RHDCSRTT by executing CA IDMS utility IDMSSRTD, or by issuing command "DCMT DISPLAY SRTT" while signed onto the CV, and reviewing the output. Note: This requires PTFs SO07995 and SO09476. Confirm that the #SECRTT macro contains entries for the following resource names: UPRF for User Profile, SYSTEM for System Dictionary, SYSMSG for System Messages, and CATSYS for the User Catalog. If all of these resource names are not defined to external security, this is a finding.

Fix Text (F-55027r807780_fix)

Secure database object resources not found in SECRTT or found to be secured internally, through the external security manager (ESM) chosen by the organization (e.g., TSS, ACF 2, RACF). Users, groups, roles, etc., are defined to the ESM, and it is here where the authorization for ownership is determined. Once externally secured, create or modify the #SECRTT entries specify TYPE=ENTRY and TYPE=OCCURRENCE for the database resource type with the parameter of SECBY=EXTERNAL. Use the RESTYPE DB which implicitly includes the subtypes AREA, NRU, QSCH, NSCH, TABL, DACC, and SACC. For each subtype, an entry must be added. The restypes for database tables and DMCLs are DBTB and DMCL, respectively. Update the #SECRTT macro to contain the following entries: #SECRTT TYPE=ENTRY, RESTYPE=UPRF, X SECBY=EXTERNAL, X Additional parameters required #SECRTT TYPE=OCCURRENCE, X RESNAME='SYSUSER', X RESTYPE=DB, X SECBY=EXTERNAL, X Additional parameters required #SECRTT TYPE=OCCURRENCE, X RESTYPE=DB, X RESNAME='SYSTEM', X SECBY=EXTERNAL, X Additional parameters required #SECRTT TYPE=OCCURRENCE, X RESTYPE=DB, X RESNAME='SYSMSG', X SECBY=EXTERNAL, X Additional parameters required #SECRTT TYPE=OCCURRENCE, X RESTYPE=DB, X RESNAME='CATSYS', X SECBY=EXTERNAL, X Additional parameters required For batch jobs that access database objects, use the ESM standard dataset security and/or the user-written exit 14 to secure the database objects.