OpenControls Logo

STIG Viewer

STIGViewer Support

ACF2/CICS parameter data sets are not protected in accordance with the proper security requirements.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-224308ZCICA011SV-224308r958616_ruleCCI-001499medium
Description
CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Unauthorized access to ACF2/CICS parameter data sets (i.e., product, security) could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.
STIGDate
z/OS IBM CICS Transaction Server for ACF2 Security Technical Implementation Guide2024-12-16

Related Frameworks

1 mapping across 3 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CHG-04.5Library Privileges
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (56) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-3(7)Role-based Access Control
1.00
AC-4Information Flow Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00

+46 more (top 10 by confidence shown)

CCI1 mapping
CCI-001499
1.00

Details

Check Text (C-224308r958616_chk)

a) Refer to the following report produced by the ACF2 Data Collection: - SENSITVE.RPT(CICSRPT) Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. b) UPDATE and/or ALLOCATE access to the ACF2/CICS parameter data set, specified on the ACF2PARM DD statement, is restricted to systems programming personnel and security personnel. c) If all items in (b) are true, there is NO FINDING. d) If any item in (b) is untrue, this is a FINDING.

Fix Text (F-25973r520245_fix)

The IAO will ensure that update and allocate access to the ACF2/CICS parameter data set is limited to system programmers and security personnel. Review the access authorizations for CICS system data sets. UPDATE and/or ALLOCATE access to the ACF2/CICS parameter data set, specified on the ACF2PARM DD statement, is restricted to systems programming personnel and security personnel. Example: $KEY(S3C) $PREFIX(SYS3) CICSTS.SYSIN UID(syspaudt) R(A) W(L) A(L) E(A) CICSTS.SYSIN UID(secaaudt) R(A) W(L) A(L) E(A) CICSTS.SYSIN UID(*) PREVENT SET RULE COMPILE 'ACF2.MVA.DSNRULES(S3C)' STORE