Select any two versions of this STIG to compare the individual requirements
Select any old version/release of this STIG to view the previous requirements
Refer to the JCL procedure libraries defined to JES2 for the SDSF started task member for SDSFPARM DD statement. Refer to the ISRPRMxx members in the logical PARMLIB concatenation. Refer to the results of the "F SDSF,D" command. Where SDSF should specify the SDSF started task name. Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(ZISF0040) Ensure the following Group Parameters are specified or not specified in the GROUP statements defined in the ISFPARMS members. If the following guidance is true, this is not a finding. For each GROUP statement: AUPDT(0) AUTH will not be specified CMDAUTH will not be specified CMDLEV will not be specified DSPAUTH will not be specified NAME a value will be specified for the NAME
Ensure that the following Group function parameters appear and/or do not appear in ISFPARMS. For each GROUP statement: AUPDT(0) AUTH will not be specified CMDAUTH will not be specified CMDLEV will not be specified DSPAUTH will not be specified NAME a value will be specified for the NAME The ISFPARMS GROUP statement defines user groups and their characteristics. Some of these characteristics include access authorization to SDSF functions and commands. Access to these functions and commands will be controlled using SAF resources. The use of the SAF interface is consistent with the DOD requirement to control all products within the operating system using the ACP. To ensure SAF security is always in effect, authorizations to SDSF functions and commands should not be defined in ISFPARMS DD statement in the SDSF JCL member.
Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(ISFRPT) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZISF0000) Verify that the accesses to the IBM SDSF installation data sets are properly restricted. If the following guidance is true, this is not a finding. ___ The ACF2 data set rules for the data sets restricts READ access to all authorized users. ___ The ACF2 data set rules for the data sets restricts WRITE and/or greater access to systems programming personnel. ___ The ACF2 data set rules for the data sets specify that all (i.e., failures and successes) WRITE and/or greater access is logged.
The ISSO will ensure that WRITE and/or greater access to IBM SDSF installation data sets is limited to System Programmers only, and all WRITE and/or greater access is logged. READ access can be given to all authorized users. The installing Systems Programmer will identify and document the product data sets and categorize them according to who will have WRITE and/or greater access and if required that all WRITE and/or greater access is logged, will identify if any additional groups have WRITE and/or greater access for specific data sets, and once documented, will work with the ISSO to see that they are properly restricted to the ACP (Access Control Program) active on the system. Data sets to be protected will be: SYS1.ISF.AISF SYS1.ISF.SISF The following commands are provided as a sample for implementing data set controls: $KEY(S1I) $PREFIX(SYS1) ISF.AISF-.- UID(syspaudt) R(A) W(L) A(L) E(A) ISF.SISF-.- UID(syspaudt) R(A) W(L) A(L) E(A) ISF.SISF-.- UID(authorized users/*) R(A) E(A) SET RULE COMPILE 'ACF2.MVA.DSNRULES(S1I)' STORE
If the z/OS operating system is Release 2.2 or higher this is not applicable. Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(SDSFRPT) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZISF0002) Verify that the accesses to the IBM System Display and Search Facility (SDSF) HASPINDX data set specified on the INDEX control statement in the ISFPARMS statements (identified in the SFSFPARM DD statement of the SDSF stc) are properly restricted. If the following guidance is true, this is not a finding. ___ The ACF2 data set rules for the data sets restricts READ access to the auditors. ___ The ACF2 data set rules for the data sets restricts UPDATE access to SDSF Started Tasks. ___ The ACF2 data set rules for the data sets restricts WRITE and/or greater access to systems programming personnel. Note: If running z/OS V1R11 or above, with the use of a new JES logical log, the HASPINDX, may not exist and may make this vulnerability not applicable (N/A). However if used the HASPINDX dataset must be restricted. Note: If running z/OS V1R11 systems or above and NOT using JES logical log, the HASPINDX data set must be protected.
Ensure that the HASPINDX dataset identified in the INDEX parameter value of ISFPARMS options statement is restricted as described below. The HASPINDX data set is used by SDSF when building the SYSLOG panel. This data set contains information related to all SYSLOG jobs and data sets on the spool. Since SDSF dynamically allocates this data set, explicit user access authorization to this data set should not be required. Due to the potentially sensitive data in this data set, access authorization will be restricted. READ access is restricted to the auditors. UPDATE access is restricted to SDSF Started Tasks. WRITE and/or greater access is restricted to systems programming personnel. Note: If running z/OS V1R11 or above, with the use of a new JES logical log, the HASPINDX, may not exist and may make this vulnerability not applicable (N/A). However if used the HASPINDX dataset must be restricted. Note: If running z/OS V1R11 systems or above and NOT using JES logical log, the HASPINDX data set must be protected. Data sets to be protected may be: SYS1.HASPINDX The following commands are provided as a sample for implementing data set controls: $KEY(S1H) $PREFIX(SYS1) HASPINDX.- UID(syspaudt) R(A) W(A) A(A) E(A) HASPINDX.- UID(sdsf stc) R(A) W(A) E(A) HASPINDX.- UID(audtaudt) R(A) E(A) SET RULE COMPILE 'ACF2.MVA.DSNRULES(S1H)' STORE
Refer to the following report produced by the ACF2 Data Collection and Data Set and Resource Data Collection: - SENSITVE.RPT(ZISF0020) - ACF2CMDS.RPT(RESOURCE) - Alternate report Automated Analysis requiring additional analysis. Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZISF0020) Ensure all IBM SDSF resources are properly protected according to the requirements specified in the Site Security Plan (SSP). The plan should be based on the SDSF SAF Resources table in the z/OS STIG Addendum and validated by the site ISSO. If the following guidance is true, this is not a finding. ___ The ACF2 resources and/or generic equivalent as designated in the above table are defined with a default access of NONE. ___ The ACF2 resource access authorizations restrict access to the appropriate personnel as designated in the above table. ___ The ACF2 resource logging is specified as designated in the above table. ___ The ACF2 resource access authorizations for SDSF GROUP.group-name will require additional analysis to justify access.
The ISSO will work with the systems programmer to verify that the following are properly specified in the ACP. (Note: The resource type, resources, and/or resource prefixes identified below are examples of a possible installation. The actual resource type, resources, and/or resource prefixes are determined when the product is actually installed on a system through the product's installation guide and can be site-specific.) Ensure that all IBM SDSF resources are properly protected according to the requirements specified in the Site Security Plan (SSP). The plan should be based on the SDSF SAF Resources table in the z/OS STIG Addendum and validated by the site ISSO. Use SDSF SAF Resources and SDSF SAF Resource Descriptions tables in the zOS STIG Addendum/SSP. These tables list the resources and access requirements for IBM SDSF; ensure the following guidelines are followed: The ACF2 resources and/or generic equivalent as designated in the above table are defined with a default access of NONE. The ACF2 resource access authorizations restrict access to the appropriate personnel as designated in the above table. The ACF2 resource logging is specified as designated in the above table. The ACF2 resource access authorizations for SDSF GROUP.group-name will require additional analysis to justify access. The following commands are provided as a sample for implementing resource controls: $KEY(ISFATTR) TYPE(SDS) JOBCL.- UID(operaudt) SERVICE(READ,UPDATE) ALLOW JOBCL.- UID(syspaudt) SERVICE(READ,UPDATE) ALLOW - UID(*) PREVENT
Refer to the following report produced by the ACF2 Data Collection and Data Set and Resource Data Collection: - SENSITVE.RPT(ZISF0021) - ACF2CMDS.RPT(RESOURCE) - Alternate report Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZISF0021) Ensure that all SDSF resources are properly protected according to the requirements specified in the SDSF Server OPERCMDS Resources table in the z/OS STIG Addendum. If the following guidance is true, this is not a finding. ___ The ACF2 resources and/or generic equivalent as designated in the above table are defined with a default access of NONE. ___ The ACF2 resource access authorizations restrict access to the appropriate personnel as designated in the above table. ___ The ACF2 resource logging is specified as designated in the above table.
The ISSO will work with the systems programmer to verify that the following are properly specified in the ACP. Ensure that the IBM SDSF resource access is in accordance with those outlined in SDSF Server OPERCMDS Resources table in the zOS STIG Addendum. Use SDSF Server OPERCMDS Resources table in the zOS STIG Addendum. These tables list the resources and access requirements for IBM SDSF; ensure the following guidelines are followed: The ACF2 resources and/or generic equivalent as designated in the above table are defined with a default access of NONE. The ACF2 resource access authorizations restrict access to the appropriate personnel as designated in the above table. The ACF2 resource logging is specified as designated in the above table. The following commands are provided as a sample for implementing resource controls: $KEY(SDSF) TYPE(OPR) MODIFY.DISPLAY UID(audtaudt) SERVICE(READ) MODIFY.DISPLAY UID(operaudt) SERVICE(READ) MODIFY.DISPLAY UID(syspaudt) SERVICE(READ) MODIFY.- UID(syspaudt) SERVICE(READ,UPDATE,DELETE) LOG - UID(*) PREVENT
Refer to the following report produced by the ACF2 Data Collection: - ACF2CMDS.RPT(ATTSTC) Verify that the logonid(s) for the IBM SDSF started task(s) is (are) properly defined. If the following attributes are defined, this is not a finding. STC
The ISSO working with the systems programmer will ensure the IBM SDSF Started Task(s) is properly identified and/or defined to the System ACP. If the product requires a Started Task, verify that it is properly defined to the System ACP with the proper attributes. Most installation manuals will indicate how a Started Task is identified and any additional attributes that must be specified. The following commands are provided as a sample for defining Started Task(s): SET LID insert SDSF stc name('STC, SDSF')
Refer to the following report produced by the ACF2 Data Collection: - ACF2CMDS.RPT(ACFGSO) If the following GSO CLASMAP record entry(ies) is (are) defined, this is not a finding. CLASMAP.SDSF RESOURCE(SDSF) RSRCTYPE(xxx) ENTITYLN(nn) Note: The site determines the appropriate three-letter RSRCTYPE that is unique for the SDSF. The ENTITYLN must be appropriate for the site's installation.
Use SAF security to define and protect the IBM SDSF resource class(es). Use the following commands as an example: CLASMAP.SDSF RESOURCE(SDSF) RSRCTYPE(SDF) ENTITYLN(39)