IBM Hardware Management Console (HMC) STIG Policies

V1R2 2015-01-14       U_IBM_Hardware_Management_Console_Policy_V1R2_STIG_Manual-xccdf.xml
V1R2 2015-01-14       U_IBM_Hardware_Management_Console_Policy_V1R2_STIG_Manual-xccdf.xml
Policy and Documentation Vulnerabilities for IBM Hardware Management Console (HMC).
Comparison
All 4
No Change 4
Updated 0
Added 0
Removed 0
V-24841 No Change
Findings ID: HMCP0010 Rule ID: SV-30530r1_rule Severity: low CCI: CCI-000904

Discussion

If procedures for performing IPLs are not in place, it is extremely difficult to ensure overall operating system integrity.System AdministratorInformation Assurance OfficerInformation Assurance ManagerSystems ProgrammerCOTR-1

Checks

Have the Systems Administrator validate that IPL Procedures Documentation exists for all partitions that are defined on the system.

Using the Hardware Management Console, do the following:

1) Access CPC Images Group displays. (This will list the LPARs.)

2) Compare the partition names listed on the Partition Page to validate that IPL procedures exist for each entered on the Central Processor Complex Domain/LPAR Names.

If IPL Procedures do not exist for each partition, this is a FINDING.

Fix

Create or refine procedures for performing IPLs for the LPARs/partitions defined on the system.
V-24842 No Change
Findings ID: HMCP0110 Rule ID: SV-30531r1_rule Severity: low CCI: CCI-000904

Discussion

If procedures for performing PORs are not in place, it is extremely difficult to ensure overall operating system integritySystem AdministratorInformation Assurance OfficerInformation Assurance ManagerSystems ProgrammerCOTR-1

Checks

Review the POR procedures with the System Administrator.
Review documentation for completeness and accuracy.

If no documentation exists, this is a FINDING



Fix

Create or refine procedures for performing PORs.

V-24843 No Change
Findings ID: HMCP0120 Rule ID: SV-30532r1_rule Severity: low CCI: CCI-000904

Discussion

If procedures for performing system shutdowns are not in place, it is extremely difficult to ensure overall data and operating system integrity.System AdministratorInformation Assurance OfficerInformation Assurance ManagerSystems ProgrammerCOTR-1

Checks

Have the System Administrator validate that System Shutdown Documentation exists for all partitions that are defined on the system.

a) Using the Hardware Management Console, do the following:

1) Access CPC Images Group displays. (This will list the LPARs.)

2) Compare the partition names listed on the Partition Page to validate that System Shutdown procedures exist for each entered on the Central Processor Complex Domain/LPAR Names.

If System Shutdown Procedures do not exist for each partition, this is a FINDING.


Fix

Create or refine procedures for performing system shutdowns for each partition.
V-24844 No Change
Findings ID: HMCP0130 Rule ID: SV-30533r1_rule Severity: medium CCI: CCI-000537

Discussion

If procedures for performing backup and recovery of critical data for the HMC is not in place, system recoverability may be jeopardized and overall security compromised.System AdministratorInformation Assurance OfficerInformation Assurance ManagerSystems ProgrammerCOTR-1

Checks

Review the documentation for backup of critical data for a HMC with the System Administrator.
Review documentation for completeness and accuracy.

If no documentation exists, this is a FINDING.

Fix

Verify that procedures for backup of the critical data for the HMCs are properly documented. If not, create Backup Procedures documentation.

CPC data should be backed-up when configuration or CPC- licensed internal code changes have been made or as a routine preventive maintenance procedure.