OpenControls Logo

STIG Viewer

STIGViewer Support

User timeout parameter values for WebSphere MQ queue managers are not specified in accordance with security requirements.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-224357ZWMQ0020SV-224357r1070071_ruleCCI-000057medium
Description
Users signed on to a WebSphere MQ queue manager could leave their terminals unattended for long periods of time. This may allow unauthorized individuals to gain access to WebSphere MQ resources and application data. This exposure could compromise the availability, integrity, and confidentiality of some system services and application data.
STIGDate
zOS WebsphereMQ for ACF2 Security Technical Implementation Guide2025-02-24

Related Frameworks

2 mappings across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

NET-07Network Connection Termination
1.00
IAC-24Session Lock
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (34) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-11Device Lock
1.00
AC-11(1)Pattern-hiding Displays
1.00
AC-12Session Termination
1.00
AC-12(2)Termination Message
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-7Unsuccessful Logon Attempts
1.00

+24 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.10
1.00
3.13.9
1.00
CCI2 mappings
CCI-000057
1.00
CCI-001133
1.00

Details

Check Text (C-224357r1070071_chk)

Refer to the following report produced by the z/OS Data Collection: - MQSRPT(ssid) NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(ZWMQ0020) Review the ssid report(s) and perform the following steps: 1. Find the DISPLAY SECURITY command to locate the start of the security parameter settings. 2. Review the CSQH015I and CSQH016I messages to determine the Timeout and Interval parameter settings respectively. 3. Repeat these steps for each queue manager ssid. The standard values are: TIMEOUT(15) INTERVAL(5) If the Timeout and Interval values conform to the standard values, this is not a finding. If the Timeout and/or Interval values do not conform to the standard values, this is a finding.

Fix Text (F-26022r1070070_fix)

Review the WebSphere MQ System Setup Guide and the information on the ALTER SECURITY command in the WebSphere MQ Script (MQSC) Command Reference. Ensure the values for the TIMEOUT and INTERVAL parameters are specified in accordance with security requirements.