z/OS ROSCOE for ACF2 Security Technical Implementation Guide

Overview

VersionDateFinding Count (6)Downloads
72025-02-25CAT I (High): 0CAT II (Medium): 6CAT III (Low): 0
STIG Description
This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
ClassifiedPublicSensitive
I - Mission Critical ClassifiedI - Mission Critical PublicI - Mission Critical Sensitive
II - Mission Support ClassifiedII - Mission Support PublicII - Mission Support Sensitive
III - Administrative ClassifiedIII - Administrative PublicIII - Administrative Sensitive

Findings - MAC II - Mission Support Sensitive

Finding IDSeverityTitleDescription
V-224336
LOWMEDIUMHIGH
ROSCOE Install data sets are not properly protected.ROSCOE Install data sets provide the capability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access ...
V-224337
LOWMEDIUMHIGH
ROSCOE STC data sets are not properly protected.ROSCOE STC data sets provide the capability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to t...
V-224338
LOWMEDIUMHIGH
ROSCOE resources must be properly defined and protected.ROSCOE can run with sensitive system privileges, and potentially can circumvent system controls. Failure to properly control access to product resourc...
V-224339
LOWMEDIUMHIGH
ROSCOE Started Task name is not properly identified / defined to the system ACP.Products that require a started task will require that the started task be restricted to certain resources, datasets and other system functions. By de...
V-224340
LOWMEDIUMHIGH
The ROSCOE's Resource Class is not defined or active in the ACP.Failure to use a robust ACP to control a product could potentially compromise the integrity and availability of the MVS operating system and user data...
V-224341
LOWMEDIUMHIGH
ROSCOE configuration/parameter values are not specified properly.Product configuration/parameters control the security and operational characteristics of products. If these parameter values are improperly specified,...