OpenControls Logo

STIG Viewer

STIGViewer Support

WebSphere MQ connection class resources must be protected properly.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-225631ZWMQ0052SV-225631r1146221_ruleCCI-002234medium
Description
WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.
STIGDate
zOS WebSphere MQ for TSS Security Technical Implementation Guide2025-09-28

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

IAC-21.4Auditing Use of Privileged Functions
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (34) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00
AC-4Information Flow Enforcement
1.00
AC-6(8)Privilege Levels for Code Execution
1.00
AC-6(9)Log Use of Privileged Functions
1.00
AU-10Non-repudiation
1.00
AU-12Audit Record Generation
1.00
AU-12(3)Changes by Authorized Individuals
1.00

+24 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.7
1.00
CCI1 mapping
CCI-002234
1.00

Details

Check Text (C-225631r1146221_chk)

Refer to the following report produced by the TSS Data Collection: - SENSITVE.RPT(WHOHMCON). Review the following connection resources for each queue manager defined to the connection resource class: Resource Authorized Users ssid.BATCH TSO and batch job ACIDs ssid.CICS CICS region ACIDs ssid.IMS IMS region ACIDs ssid.CHIN Channel initiator ACIDs Note: ssid is the queue manager name (a.k.a., subsystem identifier). For all connection resources defined to the MQCONN, if the following guidance is true, this is not a finding. Access authorization restricts access to the appropriate users as indicated above. All access FAILUREs are logged.

Fix Text (F-27320r1146220_fix)

Review the following connection resources defined to the MQCONN or MXCONN resource class: Resource Authorized Users ssid.BATCH TSO and batch job ACIDs ssid.CICS CICS region ACIDs ssid.IMS IMS region ACIDs ssid.CHIN Channel initiator ACIDs Note: ssid is the queue manager name (a.k.a., subsystem identifier). For all connection resources defined to the MQCONN or MXCONN resource class, ensure the following items are in effect: Access authorization restricts access to the appropriate users as indicated above. All access FAILUREs are logged. The following is a sample of the commands required to allow a batch user (USER1) to connect to a queue manager (QM1): TSS ADD(USER1) FAC(QM1MSTR) TSS PER(USER1) MQCONN(QM1.BATCH) ACC(READ)