Cyber Trackr - Free Compliance Library
Cyber Trackr
The Free Compliance Library

z/OS IBM CICS Transaction Server for RACF Security Technical Implementation Guide

  • Version/Release: V6R9
  • Published: 2023-03-21
  • Expand All:
  • Severity:
  • Sort:
Compare

Select any two versions of this STIG to compare the individual requirements

View

Select any old version/release of this STIG to view the previous requirements

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: [email protected].
b
CICS system data sets are not properly protected.
CM-5 - Medium - CCI-001499 - V-224492 - SV-224492r520264_rule
RMF Control
CM-5
Severity
Medium
CCI
CCI-001499
Version
ZCIC0010
Vuln IDs
  • V-224492
  • V-7516
Rule IDs
  • SV-224492r520264_rule
  • SV-7978
CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Unauthorized access to CICS system data sets (i.e., product, security, and application libraries) could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.
Checks: C-26175r520262_chk

a) Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(CICSRPT) Since it is possible to have multiple CICS regions running on an LPAR, it is recommended that you go into the z/OS STIG Addendum and fill out all the information in the "CICS System Programmers Worksheet" for each CICS region running on your LPAR. It is recommended that you save this information for any other CICS vulnerabilities that will require it. b) WRITE and/or ALLOCATE access to CICS system data sets is restricted to systems programming personnel. c) If (b) is true, there is NO FINDING. d) If (b) is untrue, this is a FINDING.

Fix: F-26163r520263_fix

Review the access authorizations for CICS system data sets for each region. Ensure they conform to the specifications below: A CICS environment may include several data set types required for operation. Typically they are CICS product libraries, which are usually included in the STEPLIB concatenation but may be found in DD DFHRPL. CICS system data sets that can be identified with DFH DD statements, other product system data sets, and application program libraries. Restrict alter and update access to CICS program libraries and all system data sets to systems programmers only. Other access must be documented and approved by the IAO. The site may determine access to application data sets included in the DD DFHRPL and CICS region startup JCL according to need. Ensure that procedures are established; documented, and followed that prevents the introduction of unauthorized or untested application programs into production application systems.

b
Sensitive CICS transactions are not protected in accordance with security requirements.
AC-3 - Medium - CCI-000213 - V-224493 - SV-224493r520267_rule
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
ZCIC0020
Vuln IDs
  • V-224493
  • V-251
Rule IDs
  • SV-224493r520267_rule
  • SV-7528
Sensitive CICS transactions offer the ability to circumvent transaction level controls for accessing resources under CICS. These transactions must be protected so that only authorized users can access them. Unauthorized use can result in the compromise of the confidentiality, integrity, and availability of the operating system or customer data.
Checks: C-26176r520265_chk

a) Refer to the following reports produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(TCICSTRN) - SENSITVE.RPT(GCICSTRN) NOTE: If a CICS region is using a site-defined transaction resource class pair, execute a RACF RLIST command against these resource classes. Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. b) Ensure the following items are in effect for all CICS regions: 1) Transactions listed in tables CICS CATEGORY 2 CICS AND OTHER PRODUCT TRANSACTIONS and CICS CATEGORY 4 COTS-SUPPLIED SENSITIVE TRANSACTIONS, in the z/OS STIG Addendum, are restricted to authorized personnel. Note: The exception to this is the CEOT and CSGM transactions, which can be made available to all users. Note: The exception to this is the CWBA transaction, can be made available to the CICS Default user. Note: The transactions beginning with "CK" apply to regions running WebSphere MQ. Note: Category 1 transactions are internally restricted to CICS region userids. c) If the items mentioned in (b) are true for all CICS transaction resource classes, there is NO FINDING. d) If any item mentioned in (b) is untrue for a CICS transaction resource class, this is a FINDING.

Fix: F-26164r520266_fix

Develop a plan to implement the required changes. 1. Most transactions are protected in groups. An example would be "L2TRANS" which would contain all Category 2 transactions. L2TRANS is defined to RACF as a profile and contains all the Category 2 transactions. An example of how to implement this within RACF is shown here: RDEF GCICSTRN L2TRANS UACC(NONE) OWNER(ADMIN) AUDIT(ALL(READ)) RALT GCICSTRN L2TRANS ADDMEM(CADP CBAM CDBC) Permission to the transaction group can be accomplished with a sample command: PE L2TRANS CL(GCICSTRN) id(<syspaudt>) Note that a refresh is generally needed to the member class. In this case TCICSTRN is the member class for GCICSTRN and a sample refresh command is SETR RACL(TCICSTRN) REFRESH 2. Transactions groups should be defined and permitted in accordance with the CICS Transaction tables listed in the zOS STIG Addendum.

b
CICS System Initialization Table (SIT) parameter values must be specified in accordance with proper security requirements.
CM-6 - Medium - CCI-000366 - V-224494 - SV-224494r868325_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
ZCIC0030
Vuln IDs
  • V-224494
  • V-302
Rule IDs
  • SV-224494r868325_rule
  • SV-7530
The CICS SIT is used to define system operation and configuration parameters of a CICS system. Several of these parameters control the security within a CICS region. Failure to code the appropriate values could result in unexpected operations and degraded security. This exposure may result in unauthorized access impacting the confidentiality, integrity, and availability of the CICS region, applications, and customer data.
Checks: C-26177r868323_chk

Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(CICSPROC) Refer to the following report produced by the CICS Data Collection: - CICS.RPT(DFHSITxx) Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. Refer to the CICS region SYSLOG - (Alternate source of SIT parameters) be sure to process DFHSIT based on the order specified. The system initialization parameters are processed in the following order, with later system initialization parameter values overriding those specified earlier. CICS system initialization parameters are specified in the following ways: - In the system initialization table, loaded from a library in the STEPLIB concatenation of the CICS startup procedure. - In the PARM parameter of the EXEC PGM=DFHSIP statement of the CICS startup procedure. - In the SYSIN data set defined in the startup procedure (but only if SYSIN is coded in the PARM parameter). Ensure the following CICS System Initialization Table (SIT) parameter settings are specified for each CICS region. If the following guidance is true, this is not a finding. ___ SEC=YES - If SEC is not coded in the CICS region startup JCL, go to offset x'117' from the beginning on the SIT dump (record sequence number - 6) for a length of 1. This is the security byte flag. Below is the hex and bit settings for this flag. X'80' EQU B'10000000' External Security Requested ___ DFLTUSER=&lt;parameter&gt; - If DFLTUSER is not coded in the CICS region startup JCL, go to offset x'118' from the beginning on the SIT dump (record sequence number - 6) for a length of 8 bytes. The value will be the CICS default userid. ___ XUSER=YES - If XUSER is not coded in the CICS region startup JCL, go to offset x'117' from the beginning on the SIT dump (record sequence number - 6) for a length of 1. This is the security byte flag. Below is the hex and bit settings for this flag. X'04' EQU B'00000100' Surrogate User Checking required ___ SNSCOPE=NONE|CICS|MVSIMAGE|SYSPLEX - If SNSCOPE is not coded in the CICS region startup JCL, go to offset x'124' from the beginning on the SIT dump (record sequence number - 6) for a length of 1. This is the signon scope byte flag. Ensure that users cannot sign on to more than one CICS production region within the scope of a single CICS region, a single z/OS image, or a sysplex. Below are listed the hex and bit settings for this flag: X'01' EQU 1 SIGNON SCOPE = NONE X'02' EQU 2 SIGNON SCOPE = CICS X'03' EQU 3 SIGNON SCOPE = MVSIMAGE X'04' EQU 4 SIGNON SCOPE = SYSPLEX Note: SNSCOPE=NONE is only allowed with test/development regions. ___ XTRAN=YES|ssrrTRN - If XTRAN is not coded in the CICS region startup JCL, go to offset x'CA' from the beginning on the SIT dump (record sequence number - 6) for a length of 7 bytes. The value will be the resource class name used for that region. If XTRAN=YES is coded, c'CICSTRN' will be present. ___ SECPRFX=YES - If SECPRFX is not coded in the CICS region startup JCL, go to offset x'117' from the beginning on the SIT dump (record sequence number - 6) for a length of 1. This is the security byte flag. Below are the hex and bit settings for this flag. X'40' EQU B'01000000' Resource Prefix Required If XTRAN=ssrrTRN is specified, resource prefixing (e.g., SECPRFX=YES) is not required to be enabled. Also, CICS regions cannot share the same resource class if resource prefixing is not active.

Fix: F-26165r868324_fix

Ensure that CICS System Initialization Table (SIT) parameter values are specified using the following guidance. The system initialization parameters are processed in the following order, with later system initialization parameter values overriding those specified earlier. CICS system initialization parameters are specified in the following ways: In the system initialization table, loaded from a library in the STEPLIB concatenation of the CICS startup procedure. In the PARM parameter of the EXEC PGM=DFHSIP statement of the CICS startup procedure. In the SYSIN data set defined in the startup procedure (but only if SYSIN is coded in the PARM parameter). SEC=YES - If SEC is not coded in the CICS region startup JCL, go to offset x'117' from the beginning on the SIT dump (record sequence number - 6) for a length of 1. This is the security byte flag. Below are is the hex and bit settings for this flag. X'80' EQU B'10000000' External Security Requested <<=== X'40' EQU B'01000000' Resource Prefix Required X'10' EQU B'00010000' RACLIST class APPCLU required X'08' EQU B'00001000' ESM INSTLN data is required X'04' EQU B'00000100' Surrogate User Checking required X'02' EQU B'00000010' Always enact resource check X'01' EQU B'00000001' Always enact command check DFLTUSER=<parameter> - If DFLTUSER is not coded in the CICS region startup JCL, go to offset x'118' from the beginning on the SIT dump (record sequence number - 6) for a length of 8 bytes. The value will be the CICS default userid. XUSER=YES - If XUSER is not coded in the CICS region startup JCL, go to offset x'117' from the beginning on the SIT dump (record sequence number - 6) for a length of 1. This is the security byte flag. Below is the hex and bit settings for this flag. X'80' EQU B'10000000' External Security Requested X'40' EQU B'01000000' Resource Prefix Required X'10' EQU B'00010000' RACLIST class APPCLU required X'08' EQU B'00001000' ESM INSTLN data is required X'04' EQU B'00000100' Surrogate User Checking required <<=== X'02' EQU B'00000010' Always enact resource check X'01' EQU B'00000001' Always enact command check SNSCOPE=NONE|CICS|MVSIMAGE|SYSPLEX If SNSCOPE is not coded in the CICS region startup JCL, go to offset x'124' from the beginning on the SIT dump (record sequence number - 6) for a length of 1. This is the signon scope byte flag. Ensure that users cannot sign on to more than one CICS production region within the scope of a single CICS region, a single z/OS image, or a sysplex. Below are the hex settings for this flag: X'01' EQU 1 SIGNON SCOPE = NONE X'02' EQU 2 SIGNON SCOPE = CICS X'03' EQU 3 SIGNON SCOPE = MVSIMAGE X'04' EQU 4 SIGNON SCOPE = SYSPLEX Note: SNSCOPE=NONE is only allowed with test/development regions. XTRAN=YES|ssrrTRN - If XTRAN is not coded in the CICS region startup JCL, go to offset x'CA' from the beginning on the SIT dump (record sequence number - 6) for a length of 7 bytes. The value will be the resource class name used for that region. If XTRAN=YES is coded, c'CICSTRN' will be present. SECPRFX=YES - If SECPRFX is not coded in the CICS region startup JCL, go to offset x'117' from the beginning on the SIT dump (record sequence number - 6) for a length of 1. This is the security byte flag. Below are the hex and bit settings for this flag with the resource prefixing setting bolded: X'80' EQU B'10000000' External Security Requested X'40' EQU B'01000000' Resource Prefix Required <<=== X'10' EQU B'00010000' RACLIST class APPCLU required X'08' EQU B'00001000' ESM INSTLN data is required X'04' EQU B'00000100' Surrogate User Checking required X'02' EQU B'00000010' Always enact resource check X'01' EQU B'00000001' Always enact command check Note: If XTRAN=ssrrTRN is specified, resource prefixing (e.g., SECPRFX=YES) is not required to be enabled. Also, CICS regions cannot share the same resource class if resource prefixing is not active.

b
CICS region logonid(s) must be defined and/or controlled in accordance with the security requirements.
IA-2 - Medium - CCI-000764 - V-224495 - SV-224495r520273_rule
RMF Control
IA-2
Severity
Medium
CCI
CCI-000764
Version
ZCIC0040
Vuln IDs
  • V-224495
  • V-44
Rule IDs
  • SV-224495r520273_rule
  • SV-7532
CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS region userids may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data. The region userid should be associated with a unique RACF userid.
Checks: C-26178r520271_chk

a) Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(CICSPROC) Refer to the following reports produced by the RACF Data Collection: - RACFCMDS.RPT(LISTUSER) - DSMON.RPT(RACCDT) Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. b) Ensure that the following is defined for each CICS region: 1) A unique userid is defined. 2) Defined to the STARTED resource class. c) If (b) is true, this is not a finding. d) If (b) is untrue, this is a finding.

Fix: F-26166r520272_fix

Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required. Ensure that the following is defined for each CICS region: 1) A unique userid is defined. Use the RACF Adduser command to accomplish this. A sample command is provided here: AU <cicsregionid> NAME('STC, CICS Region') DFLTGRP(STC) OWNER(STC) 2) Defined to the STARTED resource class. Use the RACF RDEFINE command. A sample is provided here: RDEF STARTED <cicsprocname>.** UACC(NONE) OWNER(ADMIN) DATA('USED TO MAP <cicsprocname> TO A VALID RACF USERID') STDATA(USER(=MEMBER) GROUP(STC) TRACE(YES))

b
CICS default logonid(s) must be defined and/or controlled in accordance with the security requirements.
IA-2 - Medium - CCI-000764 - V-224496 - SV-224496r904396_rule
RMF Control
IA-2
Severity
Medium
CCI
CCI-000764
Version
ZCIC0041
Vuln IDs
  • V-224496
  • V-7119
Rule IDs
  • SV-224496r904396_rule
  • SV-7536
CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. An improperly defined or controlled CICS default userid may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.
Checks: C-26179r904395_chk

a) Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(CICSPROC) Refer to the following reports produced by the RACF Data Collection: - RACFCMDS.RPT(LISTUSER) - SENSITVE.RPT(TCICSTRN) - SENSITVE.RPT(GCICSTRN) NOTE: If a CICS region is using a site-defined transaction resource class pair, execute a RACF RLIST command against these resource classes. Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. b) Ensure the following items are in effect for the CICS default userid (i.e., DFLTUSER=default userid): 1) Not granted the RACF OPERATIONS attribute. 2) No access to interactive on-line facilities (e.g., TSO) other than CICS. 3) TIMEOUT parameter in the CICS segment is set to 15 minutes. 4) A system's default time for terminal lock-out or session termination may be lengthened to 30 minutes at the discretion of the ISSM. The ISSM will maintain the documentation for each system with a time-out adjusted beyond the 15-minute recommendation to explain the basis for this decision. 5) Restricted from accessing all data sets and resources with the following exceptions: (a) Non-restricted CICS transactions (e.g., CESF, CESN, 'good morning' transaction, etc.) (b) If applicable, resources necessary to operate in an intersystem communication (ISC) environment (i.e., LU6.1, LU6.2, and MRO) Note: Refer to the IBM CICS Transaction Server Resource Definition Guide for latest and most accurate definition for the Default CICS User. Note: Any exceptions to these guidelines must be approved by the site ISSO and documented in site security plan. NOTE: Execute the JCL in CNTL(IRRUT100) using the CICS default userid as SYSIN input. This report lists all occurrences of this userid within the RACF database, including data set and resource access lists. c) If all items in (b) are true, this not a finding. d) If any item in (b) is untrue, this is a finding.

Fix: F-26167r868327_fix

Ensure the following items are in effect for the CICS default userid (i.e., DFLTUSER=default userid): 1) Not granted the RACF OPERATIONS attribute. a) Issue a RACF LU (Listuser) command on the CICS default userid. b) The OPERATIONS attribute can be removed via the RACF command ALU <cicsdefaultuser> NOOPERATIONS 2) No access to interactive on-line facilities (e.g., TSO) other than CICS. a) Use the RACF ALU (Altuser) command to remove attributes such as TSO. Example: ALU <cicsdefaultuser> NOTSO 3) TIMEOUT parameter in the CICS segment is set to 15 minutes. 4) A system's default time for terminal lock-out or session termination may be lengthened to 30 minutes at the discretion of the ISSM. The ISSM will maintain the documentation for each system with a time-out adjusted beyond the 15-minute recommendation to explain the basis for this decision. a) Use the RACF LU (ListUser) command to display the CICS segment. An example is shown here: LU <cicsdefaultuser> CICS b) Use the RACF ALU command to set the 15 minute timeout value. An example is shown here: ALU <cicsdefaultuser> CICS(TIMEOUT(15)) 5) Restricted from accessing all data sets and resources with the following exceptions: a) Delete the CICS default user from dataset access lists via the command: PE '<dataset profile name>' ID(<cicsdefaultuser>) DEL (a) Non-restricted CICS transactions (e.g., CESF, CESN, 'good morning' transaction, etc.) (b) If applicable, resources necessary to operate in an intersystem communication (ISC) environment (i.e., LU6.1, LU6.2, and MRO) NOTE: Execute the JCL in CNTL(IRRUT100) using the CICS default userid as SYSIN input. This report lists all occurrences of this userid within the RACF database, including data set and resource access lists. c) If all items in (b) are true, there is no finding. d) If any item in (b) is untrue, this is a finding.

b
CICS logonid(s) must have time-out limit set to 15 minutes.
AC-11 - Medium - CCI-000057 - V-224497 - SV-224497r868330_rule
RMF Control
AC-11
Severity
Medium
CCI
CCI-000057
Version
ZCIC0042
Vuln IDs
  • V-224497
  • V-7120
Rule IDs
  • SV-224497r868330_rule
  • SV-7540
CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS region userids may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data. RACF provides the PROPCNTL class to prevent userids such as the CICS region userid from being propagated/used by unauthorized userids.
Checks: C-26180r868329_chk

a) Refer to the following report produced by the RACF Data Collection: - RACFCMDS.RPT(LISTUSER) Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. NOTE: Any userid that does not have a TIMEOUT parameter specified will obtain its TIMEOUT parameter from the default value set in ZCIC0041. Any userid that specifies a TIMEOUT parameter must meet the requirements specified below. b) Ensure that all userids with a CICS segment have the TIMEOUT parameter set to 15 minutes. c) If (b) is true for each CICS region and/or CICS user, there is no finding. NOTE: If the time-out limit is greater than 15 minutes, and the system is processing unclassified information, review the following items. If any of these is true, there is no finding. 1) If a session is not terminated, but instead is locked out after 15 minutes of inactivity, a process must be in place that requires user identification and authentication before the session is unlocked. Session lock-out will be implemented through system controls or terminal screen protection. 2) A system's default time for terminal lock-out or session termination may be lengthened to 30 minutes at the discretion of the ISSM. The ISSM will maintain the documentation for each system with a time-out adjusted beyond the 15-minute recommendation to explain the basis for this decision. 3) The ISSM may set selected userids to have a time-out of up to 60 minutes in order to complete critical reports or transactions without timing out. Each exception must meet the following criteria: (a) The time-out exception cannot exceed 60 minutes. (b) A letter of justification fully documenting the user requirement(s) must be submitted and approved by the site ISSM. In addition, this letter must identify an alternate means of access control for the terminal(s) involved (e.g., a room that is locked at all times, a room with a cipher lock to limit access, a password protected screen saver set to 30 minutes or less, etc.). (c) The requirement must be revalidated on an annual basis. c) If the CICS time-out limit is not specified for 15 minutes of inactivity, and the previously mentioned exceptions do not apply, this is a finding.

Fix: F-26168r520278_fix

Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required. Ensure that all userids with a CICS segment have the TIMEOUT parameter set to 15 minutes. Examples: Use the RACF ALtUser command to assign the required value: ALU <cics user> CICS(TIMEOUT(15))

b
IBM CICS Transaction Server SPI command resources must be properly defined and protected.
AC-4 - Medium - CCI-000035 - V-224498 - SV-224498r904393_rule
RMF Control
AC-4
Severity
Medium
CCI
CCI-000035
Version
ZCICR021
Vuln IDs
  • V-224498
  • V-17982
Rule IDs
  • SV-224498r904393_rule
  • SV-43225
IBM CICS Transaction Server can run with sensitive system privileges, and potentially can circumvent system controls. Failure to properly control access to product resources could result in the compromise of the operating system environment, and compromise the confidentiality of customer data. Many utilities assign resource controls that can be granted to system programmers only in greater than read authority. Resources are also granted to certain non systems personnel with read only authority.
Checks: C-26181r904342_chk

Refer to the following report produced by the Data Set and Resource Data Collection: SENSITVE.RPT(CCICSCMD) SENSITVE.RPT(VCICSCMD) Automated Analysis: Refer to the following report produced by the RACF Data Collection Checklist: - PDI (ZCIC0021) Ensure that all IBM CICS Transaction Server resources defined in the IBM CICS-RACF Security Guide are properly protected according to the requirements specified in CICS SPI Resources table in the site security plan. Use CICS SPI Resources table in the zOS STIG Addendum as a guide. If the following guidance is true, this is not a finding. The RACF resources and/or generic equivalent as designated in the above table are defined with a default access of NONE. The RACF resource access authorizations restrict access to the appropriate personnel as designated in the above table. The RACF resource rules for the resources designated in the above table specify UACC(NONE) and NOWARNING.

Fix: F-26169r520281_fix

Ensure that the IBM CICS Transaction Server command resources defined in the IBM CICS-RACF Security Guide access is in accordance with those outlined in the site security plan, use CICS SPI Resources table in the zOS STIG Addendum as a guide. These tables list the resources and access requirements for IBM CICS Transaction Server; ensure the following guidelines are followed: The RACF resources and/or generic equivalent as designated in the above table are defined with a default access of NONE. The RACF resource access authorizations restrict access to the appropriate personnel as designated in the above table. The RACF resource rules for the resources designated in the above table specify UACC(NONE) and NOWARNING. The following commands are provided as a sample for implementing resource controls: RDEFINE CCICSCMD ASSOCIATION.** UACC(NONE) OWNER(ADMIN) AUDIT(FAILURE(READ)) PERMIT ASSOCIATION.** CLASS(CCICSCMD) ACCESS(READ) ID(cicsaudt) PERMIT ASSOCIATION.** CLASS(CCICSCMD) ACCESS(READ) ID(cicuaudt) PERMIT ASSOCIATION.** CLASS(CCICSCMD) ACCESS(READ) ID(syscaudt)

b
External RACF Classes are not active for CICS transaction checking.
AC-3 - Medium - CCI-000213 - V-224499 - SV-224499r520285_rule
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
ZCICR038
Vuln IDs
  • V-224499
  • V-301
Rule IDs
  • SV-224499r520285_rule
  • SV-301
Implement CICS transaction security by utilizing two distinct and unique RACF resource classes (i.e., member and grouping) within each CICS region. If several CICS regions are grouped in an MRO environment, it is permissible for those grouped regions to share a common pair of resource classes. Member classes contain a RACF discrete profile for each transaction. Grouping classes contain groups of transactions requiring equal protection under RACF. Ideally, member classes contain no profiles, and all transactions are defined by groups in a grouping class. If CICS Classes are not active, this could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.
Checks: C-26182r520283_chk

a) Refer to the following report produced by the RACF Data Collection: - RACFCMDS.RPT(SETROPTS) Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. b) Ensure each CICS transaction resource class pair are active. c) If (b) is true, there is NO FINDING. d) If (b) is untrue, this is a FINDING.

Fix: F-26170r520284_fix

Review each CICS SIT to ensure each region has a unique resource class or resource prefix specified. 1. The resources classes are activated in RACF using the following command: SETR CLASSACT(<classname>)

b
CICS regions are improperly protected to prevent unauthorized propagation of the region userid.
AC-3 - Medium - CCI-000213 - V-224500 - SV-224500r520288_rule
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
ZCICR041
Vuln IDs
  • V-224500
  • V-6898
Rule IDs
  • SV-224500r520288_rule
  • SV-7193
CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.
Checks: C-26183r520286_chk

a) Refer to the following report produced by the RACF Data Collection: - SENSITVE.RPT(PROPCNTL) Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. b) Ensure the CICS region is defined to the PROPCNTL resource class. c) If (b) are true, there is NO FINDING. d) If (b) is untrue, this is a FINDING.

Fix: F-26171r520287_fix

Utilize propagation control for each CICS region. Under no circumstance should a user's batch job submitted from a CICS region execute under that CICS region's userid. To prevent this from occurring, define a profile in the PROPCNTL resource class for each CICS region. The following is an example: RDEFINE PROPCNTL <cics-region-userid> OWNER(ADMIN) AUDIT(ALL(READ)) The PROPCNTL class must be active and RACLISTed for this protection to be in effect: SETROPTS CLASSACT(PROPCNTL) RACLIST(PROPCNTL)