Cyber Trackr - Free Compliance Library
Cyber Trackr
The Free Compliance Library

zOS WebsphereMQ for TSS STIG

  • Version/Release: V6R2
  • Published: 2020-06-25
  • Expand All:
  • Severity:
  • Sort:
Compare

Select any two versions of this STIG to compare the individual requirements

View

Select any old version/release of this STIG to view the previous requirements

b
User timeout parameter values for WebSphere MQ queue managers are not specified in accordance with security requirements.
SC-10 - Medium - CCI-001133 - V-3903 - SV-3903r3_rule
RMF Control
SC-10
Severity
Medium
CCI
CCI-001133
Version
ZWMQ0020
Vuln IDs
  • V-3903
Rule IDs
  • SV-3903r3_rule
Users signed on to a WebSphere MQ queue manager could leave their terminals unattended for long periods of time. This may allow unauthorized individuals to gain access to WebSphere MQ resources and application data. This exposure could compromise the availability, integrity, and confidentiality of some system services and application data.Systems Programmer
Checks: C-19829r1_chk

a) Refer to the following report produced by the z/OS Data Collection: - MQSRPT(ssid) NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(ZWMQ0020) b) Review the ssid report(s) and perform the following steps: 1) Find the DISPLAY SECURITY command to locate the start of the security parameter settings. 2) Review the CSQH015I and CSQH016I messages to determine the Timeout and Interval parameter settings respectively. 3) Repeat these steps for each queue manager ssid. The standard values are: TIMEOUT(15) INTERVAL(5) c) If the Timeout and Interval values conform to the standard values, there is NO FINDING. d) If the Timeout and/or Interval values do not conform to the standard values, this is a FINDING.

Fix: F-18983r1_fix

Review the WebSphere MQ System Setup Guide and the information on the ALTER SECURITY command in the WebSphere MQ Script (MQSC) Command Reference. Ensure the values for the TIMEOUT and INTERVAL parameters are specified in accordance with security requirements.

b
WebSphere MQ started tasks are not defined in accordance with the proper security requirements.
IA-2 - Medium - CCI-000764 - V-3904 - SV-7527r2_rule
RMF Control
IA-2
Severity
Medium
CCI
CCI-000764
Version
ZWMQ0030
Vuln IDs
  • V-3904
Rule IDs
  • SV-7527r2_rule
Started tasks are used to execute WebSphere MQ queue manager services. Improperly defined WebSphere MQ started tasks may result in inappropriate access to application resources and the loss of accountability. This exposure could compromise the availability of some system services and application data.Information Assurance Officer
Checks: C-32940r1_chk

Refer to the following reports produced by the TSS Data Collection: - TSSCMDS.RPT(#STC) - TSSCMDS.RPT(@ACIDS) - TSSCMDS.RPT(FACLIST) - Preferred report containing all control option values in effect including default values. - TSSCMDS.RPT(TSSPRMFL) - Alternate report containing only control option values explicitly coded at TSS startup. NOTE: The FACLIST report must be created by security personnel. The TSSPRMFL report can be used if security personnel have not executed the required steps documented in the TSS Data Collection. Provide a list of all WebSphere MQ Subsystem Ids (Queue managers) and Release levels. Review WebSphere MQ started tasks and ensure the following items are in effect: NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). ssidMSTR is the name of a queue manager STC. ssidCHIN is the name of a distributed queuing (a.k.a., channel initiator) STC. 1) Each ssidMSTR and ssidCHIN started task is associated with a unique ACID. 2) Each ssidMSTR and ssidCHIN started task is defined to the STC record with a unique ACID. 3) Each ssidMSTR started task ACID has a corresponding WebSphere MQ MASTFAC defined. 4) WebSphere MQ queue manager facilities is defined to the Facility Matrix Table using the following sample commands: FAC(USERxx=NAME=ssidMSTR,MODE=FAIL,PGM=CSQ,ID=xx,ACTIVE) FAC(ssidMSTR=SHRPRF,ASUBM,NOABEND,MULTUSER,XDEF,LUMSG) FAC(ssidMSTR=STMSG,SIGN(S),INSTDATA,NORNDPW,AUTHINIT) FAC(ssidMSTR=NOPROMPT,NOAUDIT,RES,WARNPW,NOTSOC) FAC(ssidMSTR=LCFTRANS,IJU,MSGLC,NOTRACE,NOEODINIT) FAC(ssidMSTR=NODORMPW,NONPWR) FAC(ssidMSTR=LOG(INIT,SMF,MSG,SEC9)) FAC(ssidMSTR=DOWN=GLOBAL,LOCKTIME=00,DEFACID=(*NONE*))

Fix: F-29095r1_fix

Review WebSphere MQ started tasks and ensure the following items are in effect: NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). ssidMSTR is the name of a queue manager STC. ssidCHIN is the name of a distributed queuing (a.k.a., channel initiator) STC. 1) Each WebSphere MQ started task is associated with a unique ACID. 2) Each WebSphere MQ started task is defined to the STC record with a unique ACID. 3) Each ssidMSTR STC ACID has a corresponding WebSphere MQ MASTFAC as defined in the z/OS. i.e. A Started Task Table entry exists for each queue manager started task procedure xxxxMSTR and distributed queuing started task procedure xxxxCHIN. A corresponding userid for each started task exists. Queue manager and channel initiator started tasks will not be defined with the BYPASS attribute. 4) WebSphere MQ queue manager facilities are defined using the control options as specified below: Define each queue manager xxxxMSTR to the TOP SECRET Facility Matrix Table using the following sample commands: FACILITY(USERxx=NAME=xxxxMSTR) FACILITY(xxxxMSTR=MODE=FAIL,PGM=CSQ,ID=xx) FACILITY(xxxxMSTR=ACTIVE,SHRPRF,ASUBM,NOABEND) FACILITY(xxxxMSTR=MULTUSER,XDEF,LUMSG,STMSG,SIGN(S)) FACILITY(xxxxMSTR=INSTDATA,NORNDPW,AUTHINIT) FACILITY(xxxxMSTR=NOPROMPT,NOAUDIT,RES,WARNPW) FACILITY(xxxxMSTR=NOTSOC,LCFTRANS,IJU,MSGLC,NOTRACE) FACILITY(xxxxMSTR=NOEODINIT,NODORMPW,NONPWR) (INIT,SMF,MSG,SEC9)) FACILITY(xxxxMSTR=DOWN=GLOBAL,LOCKTIME=00,DEFACID=(*NONE*))

b
WebSphere MQ all update and alter access to MQSeries/WebSphere MQ product and system data sets are not properly restricted
AC-3 - Medium - CCI-000213 - V-3905 - SV-3905r3_rule
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
ZWMQ0040
Vuln IDs
  • V-3905
Rule IDs
  • SV-3905r3_rule
MVS data sets provide the configuration, operational, and executable properties of WebSphere MQ. Some data sets are responsible for the security implementation of WebSphere MQ. Failure to properly protect these data sets may lead to unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.Information Assurance Officer
Checks: C-20021r1_chk

a) Refer to the following report produced by the ACP Data Collection: - SENSITVE.RPT(MQSRPT) b) Ensure ACP data sets rules for MQSeries/WebSphere MQ system data sets (e.g., SYS2.MQM.) restrict access as follows: NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). ___ READ access to data sets referenced by the following DDnames is restricted to MQSeries/WebSphere MQ STCs, MQSeries/WebSphere MQ administrators, and system programming personnel. All access to these data sets is logged. DDname Procedure Description CSQINP1 ssidMSTR Input parameters CSQINP2 ssidMSTR Input parameters CSQXLIB ssidCHIN User exit library NOTE: WRITE/UPDATE and/or ALLOCATE/ALTER access to these data sets is restricted to MQSeries/WebSphere MQ administrators and systems programming personnel. ___ WRITE/UPDATE and/or ALLOCATE/ALTER access to data sets referenced by the following DDnames is restricted to MQSeries/WebSphere MQ STCs, MQSeries/WebSphere MQ administrators, and systems programming personnel. All WRITE and ALLOCATE access to these data sets is logged. DDname Procedure Description CSQPxxxx ssidMSTR Page data sets BSDSx ssidMSTR Bootstrap data sets CSQOUTx ssidMSTR SYSOUT data sets CSQSNAP ssidMSTR DUMP data set (See note) ssidMSTR Log data sets NOTE: To determine the log data set names, review the JESMSGLG file of the ssidMSTR active task(s). Find CSQJ001I messages to obtain DSNs. ___ ALLOCATE/ALTER access to archive data sets is restricted to MQSeries/WebSphere MQ STCs, MQSeries/WebSphere MQ administrator, and system programming personnel. All ALLOCATE/ALTER access to these data sets is logged. NOTE: To determine the archive data sets names, review the JESMSGLG file of the ssidMSTR active task(s). Find the CSQY122I message to obtain the ARCPRFX1 and ARCPRFX2 DSN HLQs. ___ Except for the specific data set requirements just mentioned, WRITE/UPDATE and/or ALLOCATE/ALTER access to all other MQSeries/WebSphere MQ system data sets is restricted to the MQSeries/WebSphere MQ administrator and system programming personnel. c) If all the items in (b) are true, there is NO FINDING. d) If any item in (b) is untrue, this is a FINDING.

Fix: F-19000r1_fix

The systems programmer will have the IAO ensure that all update and alter access to MQSeries/WebSphere MQ product and system data sets are restricted to WebSphere MQ administrators, systems programmers, and MQSeries/WebSphere MQ started tasks. The installation requires that the following data sets be APF authorized. hlqual.SCSQAUTH hlqual.SCSQLINK hlqual.SCSQANLx hlqual.SCSQSNL hlqual.SCSQMVR1 hlqual.SCSQMVR2 (2) Read access to data sets referenced by the CSQINP1, CSQINP2, and CSQXLIB DDs in the queue manager’s procedure will be restricted to the queue manager userid, WebSphere MQ administrator, and systems programming personnel. Log all access to these data sets. (3) Write and allocate access to data set profiles protecting all page sets, logs, bootstrap data sets (BSDS), and data sets referenced by the CSQOUTX and CSQSNAP DDs in the queue manager’s procedure will be restricted to the queue manager userid, WebSphere MQ administrator, and systems programming personnel. Log all write and allocate access to these data sets. (5) Allocate access to all archive data sets in the queue manager’s procedure will be restricted to the queue manager userid, WebSphere MQ administrator, and systems programming personnel. Log all allocate access to these data sets.

c
WebSphere MQ channel security must be implemented in accordance with security requirements.
AC-17 - High - CCI-000068 - V-6958 - SV-7259r6_rule
RMF Control
AC-17
Severity
High
CCI
CCI-000068
Version
ZWMQ0011
Vuln IDs
  • V-6958
Rule IDs
  • SV-7259r6_rule
WebSphere MQ Channel security can be configured to provide authentication, message privacy, and message integrity between queue managers. Secure Sockets Layer (SSL) uses encryption techniques, digital signatures and digital certificates to provide message privacy, message integrity and mutual authentication between clients and servers. Failure to properly secure a WebSphere MQ channel may lead to unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of some system services, applications, and customer data.trueInformation Assurance OfficerSystems Programmer
Checks: C-19819r3_chk

Refer to the following report produced by the z/OS Data Collection: - MQSRPT(ssid) NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). Collect the following Information for Websphere MQ and MQSeries queue manager. - If a WebSphere MQ queue manager communicates with a MQSeries queue manager, provide the WebSphere MQ queue manager and channel names used to connect with MQSeries. - If any WebSphere MQ channels are used to communicate within the enclave, provide a list of channels and provide documentation regarding the sensitivity of the information on the channel. Automated Analysis requires Additional Analysis. Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(ZWMQ0011) If the communication lines are controlled by a VPN and are not available in the clear at any point outside the enclave, than this is acceptable and can override the requirement to use SSL. If this is true, this is not a finding. If the following guidelines are true for each channel definition displayed from the DISPLAY CHANNEL command, this is not a finding. ___ Verify that each WebSphere MQ channel is using SSL by checking for the SSLCIPH parameter, which must specify a FIPS 140-2 compliant value of the following: (Note: Both ends of the channel must specify the same cipher specification.) ECDHE_ECDSA_AES_128_CBC_SHA256 ECDHE_ECDSA_AES_256_CBC_SHA384 ECDHE_RSA_AES_128_CBC_SHA256 ECDHE_RSA_AES_256_CBC_SHA384 TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA256 ___ Repeat the above step for each queue manager ssid identified.

Fix: F-18959r2_fix

The system programmer and the IAO will review the WebSphere MQ Screen interface invoked by the REXX CSQOREXX. Reviewing the channel’s SSLCIPH setting. Display the channel properties and look for the "SSL Cipher Specification" value. Ensure that a FIPS 140-2 compliant value is shown. ECDHE_ECDSA_AES_128_CBC_SHA256 ECDHE_ECDSA_AES_256_CBC_SHA384 ECDHE_RSA_AES_128_CBC_SHA256 ECDHE_RSA_AES_256_CBC_SHA384 TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_128_CBC_SHA256 TLS_RSA_WITH_AES_256_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA256 Note that both ends of the channel must specify the same cipher specification. Repeat these steps for each queue manager ssid identified.

b
WebSphere MQ security class(es) is(are) defined improperly.
AC-3 - Medium - CCI-000213 - V-6959 - SV-7535r3_rule
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
ZWMQ0049
Vuln IDs
  • V-6959
Rule IDs
  • SV-7535r3_rule
WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.Information Assurance Officer
Checks: C-20888r1_chk

Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(#RDT) - TSSCMDS.RPT(WHOOMADM) - TSSCMDS.RPT(WHOOMCMD) - TSSCMDS.RPT(WHOOMCON) - TSSCMDS.RPT(WHOOMNLI) - TSSCMDS.RPT(WHOOMPRO) - TSSCMDS.RPT(WHOOMQUE) - TSSCMDS.RPT(WHOOXADM) - TSSCMDS.RPT(WHOOXNLI) - TSSCMDS.RPT(WHOOXPRO) - TSSCMDS.RPT(WHOOXQUE) - TSSCMDS.RPT(WHOOXTOP) Ensure the following WebSphere MQ resource classes are defined to the TSS RDT: MQADMIN MQCONN MQCMDS MQNLIST MQPROC MQQUEUE For V7.0.0 and above: MXADMIN MXNLIST MXPROC MXQUEUE MXTOPIC Ensure that each ssid. resource is defined in each of the above resource classes. NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). NOTE: If both MQADMIN and MXADMIN resource classes are not defined to the RDT record, no security checking is performed.

Fix: F-302r1_fix

The IAO will ensure that all WebSphere MQ resources are defined to TSS. The following should be defined to the RDT: MQADMIN MQCONN MQCMDS MQNLIST MQPROC MQQUEUE For V7.0.0 and above: MXADMIN MXNLIST MXPROC MXQUEUE MXTOPIC Use the following commands to define (establish ownership of) resources for each WebSphere MQ subsystem to TSS: TSS ADD(deptname) MQADMIN(ssid.) TSS ADD(deptname) MQCMDS(ssid.) TSS ADD(deptname) MQCONN(ssid.) TSS ADD(deptname) MQNLIST(ssid.) TSS ADD(deptname) MQPROC(ssid.) TSS ADD(deptname) MQQUEUE(ssid.) For V7.0.0 and above: TSS ADD(deptname) MXADMIN(ssid.) TSS ADD(deptname) MXNLIST(ssid.) TSS ADD(deptname) MXPROC(ssid.) TSS ADD(deptname) MXQUEUE(ssid.) TSS ADD(deptname) MXTOPIC(ssid.) NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). Another method to ensure protection is to assign the DEFPROT attribute to the resource class in the RDT record by using the following command: TSS REP(RDT) RESCLASS(MQADMIN) ATTR(DEFPROT) TSS REP(RDT) RESCLASS(MQCMDS) ATTR(DEFPROT) TSS REP(RDT) RESCLASS(MQCONN) ATTR(DEFPROT) TSS REP(RDT) RESCLASS(MQNLIST) ATTR(DEFPROT) TSS REP(RDT) RESCLASS(MQPROC) ATTR(DEFPROT) TSS REP(RDT) RESCLASS(MQQUEUE) ATTR(DEFPROT) For V7.0.0 and above: TSS REP(RDT) RESCLASS(MXADMIN) ATTR(DEFPROT) TSS REP(RDT) RESCLASS(MXNLIST) ATTR(DEFPROT) TSS REP(RDT) RESCLASS(MXPROC) ATTR(DEFPROT) TSS REP(RDT) RESCLASS(MXQUEUE) ATTR(DEFPROT) TSS REP(RDT) RESCLASS(MXTOPIC) ATTR(DEFPROT)

c
Websphere MQ switch profiles must be properly defined to the MQADMIN class.
AC-3 - High - CCI-000213 - V-6960 - SV-7539r4_rule
RMF Control
AC-3
Severity
High
CCI
CCI-000213
Version
ZWMQ0051
Vuln IDs
  • V-6960
Rule IDs
  • SV-7539r4_rule
WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.Information Assurance Officer
Checks: C-19838r2_chk

a) Refer to the following report produced by the z/OS Data Collection: - MQSRPT(ssid) NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). Automated Analysis requires Additional Analysis. Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(ZWMQ0051) b) Review the Security switches identified in response to the DISPLAY SECURITY command in each ssid report(s). If the all of the following switches specify ON, there is NO FINDING. SUBSYSTEM CONNECTION COMMAND CONTEXT ALTERNATE USER PROCESS NAMELIST QUEUE COMMAND RESOURCES c) If SUBSYSTEM specifies OFF, this is a FINDING with a severity of Category I. d) If any of the other above switches specify OFF (other than the exception mentioned below), this is a FINDING downgrade the severity to a Category II. e) If COMMAND RESOURCE Security switch specify OFF, there is NO FINDING. NOTE: At the discretion of the IAO, COMMAND RESOURCE Security switch may specify OFF, by defining ssid.NO.CMD.RESC.CHECKS in the MQADMIN resource class.

Fix: F-18849r1_fix

Switch profiles are special WebSphere MQ profiles that are used to turn on/off security checking for a type of resource. Due to the security exposure this creates, no profiles with the first two qualifiers of ssid.NO will be defined to the MQADMIN class, with one exception. Due to the fact that (1) all sensitive WebSphere MQ commands are restricted to queue managers, channel initiators, and designated systems personnel, and (2) no command resource checking is performed on DISPLAY commands, at the discretion of the IAO a ssid.NO.CMD.RESC.CHECKS switch profile may be defined to the MQADMIN class. 1. Identify if any switch profile permissions exist using the sample TSS command: TSS WHOHAS MQADMIN(ssid.NO) 2. Use the "TSS REVOKE(acid) MQADMIN(ssid.NO)" to revoke the permission.

b
WebSphere MQ MQCONN Class resources must be protected properly.
AC-3 - Medium - CCI-000213 - V-6962 - SV-7542r4_rule
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
ZWMQ0052
Vuln IDs
  • V-6962
Rule IDs
  • SV-7542r4_rule
WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.Information Assurance Officer
Checks: C-4654r2_chk

a) Refer to the following report produced by the TSS Data Collection: - SENSITVE.RPT(WHOHMCON) b) Review the following connection resources defined to the MQCONN resource class: Resource Authorized Users ssid.BATCH TSO and batch job ACIDs ssid.CICS CICS region ACIDs ssid.IMS IMS region ACIDs ssid.CHIN Channel initiator ACIDs NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). c) For all connection resources defined to the MQCONN resource class, ensure the following items are in effect: 1) Access authorization restricts access to the appropriate users as indicated in (b) above. 2) All access FAILUREs are logged. d) If all of the items in (c) are true, there is NO FINDING. e) If any item in (c) is untrue, this is a FINDING.

Fix: F-101673r1_fix

Review the following connection resources defined to the MQCONN resource class: Resource Authorized Users ssid.BATCH TSO and batch job ACIDs ssid.CICS CICS region ACIDs ssid.IMS IMS region ACIDs ssid.CHIN Channel initiator ACIDs NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). c) For all connection resources defined to the MQCONN resource class, ensure the following items are in effect: 1) Access authorization restricts access to the appropriate users as indicated in (b) above. 2) All access FAILUREs are logged. The following is a sample of the commands required to allow a batch user (USER1) to connect to a queue manager (QM1): TSS ADD(USER1) FAC(QM1MSTR) TSS PER(USER1) MQCONN(QM1.BATCH) ACC(READ)

b
WebSphere MQ dead letter and alias dead letter queues are not properly defined.
CM-7 - Medium - CCI-001762 - V-6964 - SV-7267r3_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-001762
Version
ZWMQ0053
Vuln IDs
  • V-6964
Rule IDs
  • SV-7267r3_rule
WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.Systems Programmer
Checks: C-21013r1_chk

a) Refer to the following report produced by the z/OS Data Collection: - MQSRPT(ssid) NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). b) Review the ssid report(s) and perform the following steps: 1) Find the DISPLAY QMGR DEADQ command to locate the start of the dead-letter queue information. Review the DEADQ parameter to obtain the name of the real dead-letter queue. 2) From the top of the report, find the QUEUE(dead-letter.queue.name) entry to locate the start of the real dead-letter queue definition. Review the GET and PUT parameters to determine their values, and ensure they conform to the specified security requirements. The standard values are: GET(ENABLED) PUT(ENABLED) NOTE: Dead-letter.queue.name is the value of the DEADQ parameter determined in Step 1. 3) From the top of the report, find the QUEUE(dead-letter.queue.name.PUT) entry to locate the start of the alias dead-letter queue definition. Review the GET and PUT parameters to determine their values, and ensure they conform to those specified in the security requirements. The standard values are: GET(DISABLED) PUT(ENABLED) NOTE 1: Dead-letter.queue.name is the value of the DEADQ parameter determined in Step 1. NOTE 2: The TARGQ parameter value for the alias queue will be the real dead letter queue name. NOTE 3: If an alias queue is not used in place of the dead-letter queue, then the ACP rules for the dead-letter queue must be coded to restrict unauthorized users and systems from reading the messages on the file. c) If all of the items in (b) are true, there is NO FINDING. d) If any item in (b) is untrue, this is a FINDING.

Fix: F-18999r1_fix

The systems programmer responsible for supporting MQSeries/WebSphere MQ will ensure that the dead-letter queue and its alias are properly defined. The following scenario describes how to securely define a dead-letter queue: (1) Define the real dead-letter queue with attributes PUT(ENABLED) and GET(ENABLED). (2) Give update authority for the dead-letter queue to CKTI (the MQSeries/WebSphere MQ-supplied CICS task initiator), channel initiators, and any automated application used for dead-letter queue maintenance. (3) Define an alias queue that resolves to the real dead-letter queue, but give the alias queue the attributes PUT(ENABLED) and GET(DISABLED). (4) To put a message on the dead-letter queue, an application uses the alias queue. The application does the following: (a) Retrieve the name of the real dead-letter queue. To do this, it opens the queue manager object using MQOPEN, and then issues an MQINQ to get the dead-letter queue name. (b) Build the name of the alias queue by appending the characters “.PUT” to this name, in this case, ssid.DEAD.QUEUE.PUT. (c) Open the alias queue, ssid.DEAD.QUEUE.PUT. (d) Put the message on the real dead-letter queue by issuing an MQPUT against the alias queue. (5) Give the userid associated with the application update authority to the alias, but no access to the real dead-letter queue. NOTE: If an alias queue is not used in place of the dead-letter queue, then the ACP rules for the dead-letter queue will be coded to restrict unauthorized users and systems from reading the messages on the file. Undeliverable messages can be routed to a dead-letter queue. Two levels of access should be established for these queues. The first level allows applications, as well as some MQSeries / WebSphere MQ objects, to put messages to this queue. The second level restricts the ability to get messages from this queue and protects sensitive data. This will be accomplished by defining an alias queue that resolves to the real dead-letter queue, but defines the alias queue with the attributes PUT(ENABLED) and GET(DISABLED). The ability to get messages from the dead-letter queue will be restricted to message channel agents (MCAs), CKTI (MQSeries/WebSphere MQ-supplied CICS task initiator), channel initiators utility, and any automated application used for dead-letter queue maintenance.

b
WebSphere MQ queue resource defined to the MQQUEUE resource class are not protected in accordance with security requirements.
AC-3 - Medium - CCI-000213 - V-6965 - SV-7545r3_rule
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
ZWMQ0054
Vuln IDs
  • V-6965
Rule IDs
  • SV-7545r3_rule
WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.Information Assurance Officer
Checks: C-38933r1_chk

Refer to the following report produced by the z/OS Data Collection: - MQSRPT(ssid) NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(WHOHMQUE) For all queue identified by the DISPLAY QUEUE(*) ALL command in the MQSRPT(ssid). These queues will be prefixed by ssid to identify the resources to be protected. Ensure these queue resources are defined to the MQQUEUE resource class, if the following guidance is true, this is not a finding. 1) For message queues (i.e., ssid.queuename), access authorization restricts access to users requiring the ability to get messages from and put messages to message queues. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. Decentralized MQ Administrators, non-DECC datacenter users; can have up to ALTER access to the user Message Queues. 2) For system queues (i.e., ssid.SYSTEM.queuename), access authorization restricts UPDATE and/or ALTER access to WebSphere MQ STCs, WebSphere MQ administrators, systems programming personnel, and CICS regions running WebSphere MQ applications. 3) For the following system queues ensure that UPDATE access is restricted to Auditors and Users that require access to review message queues. ssid.SYSTEM.COMMAND.INPUT ssid.SYSTEM.COMMAND.REPLY ssid.SYSTEM.CSQOREXX.* ssid.SYSTEM.CSQUTIL.* 4) For the real dead-letter queue (to determine queue name refer to ZWMQ0053), ALTER access authorization restricts access to WebSphere MQ STCs, WebSphere MQ administrators, CICS regions running WebSphere MQ applications, and any automated application used for dead-letter queue maintenance. 5) For the alias dead-letter queue (to determine queue name refer to ZWMQ0053), UPDATE access authorization restricts access to users requiring the ability to put messages to the dead-letter queue. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list.

Fix: F-18851r1_fix

For all queue resources defined to the MQQUEUE resource class, ensure the following items are in effect: NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). For message queues (i.e., ssid.queuename), access authorization restricts access to users requiring the ability to get messages from and put messages to message queues. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. For system queues (i.e., ssid.SYSTEM.queuename), access authorization restricts access to WebSphere MQ STCs, WebSphere MQ administrators, systems programming personnel, and CICS regions running WebSphere MQ applications. For the following system queues ensure that UPDATE access is restricted to WebSphere MQ STCs, WebSphere MQ administrators, systems programming personnel, CICS regions running WebSphere MQ applications, auditors, and users that require access to review message queues. ssid.SYSTEM.COMMAND.INPUT ssid.SYSTEM.COMMAND.REPLY ssid.SYSTEM.CSQOREXX.* For the following system queues (i.e., ssid.SYSTEM.CSQUTIL.*) ensure that UPDATE access is restricted to WebSphere MQ STCs, WebSphere MQ administrators, systems programming personnel, CICS regions running WebSphere MQ applications, and auditors. For the real dead-letter queue (to determine queue name refer to ZWMQ0053), access authorization restricts access to WebSphere MQ STCs, WebSphere MQ administrators, CICS regions running WebSphere MQ applications, and any automated application used for dead-letter queue maintenance. For the alias dead-letter queue (to determine queue name refer to ZWMQ0053), access authorization restricts access to users requiring the ability to put messages to the dead-letter queue. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. NOTE: If an alias queue is not used in place of the dead-letter queue, then the RACF rules for the dead-letter queue will be coded to restrict unauthorized users and systems from reading the messages on the file. The following is a sample of the commands required to allow a user (USER1) to get messages from or put messages to queues beginning with (PAY.) on subsystem (QM1): TSS PER(USER1) MQQUEUE(QM1.PAY.) ACC(UPDATE)

b
WebSphere MQ Process resources are not protected in accordance with security requirements.
AC-3 - Medium - CCI-000213 - V-6966 - SV-7547r3_rule
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
ZWMQ0055
Vuln IDs
  • V-6966
Rule IDs
  • SV-7547r3_rule
WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.Information Assurance Officer
Checks: C-4664r1_chk

a) Refer to the following report produced by the TSS Data Collection: - SENSITVE.RPT(WHOHMPRO) b) For all process resources (i.e., ssid.processname) defined to MQPROC resource class, ensure access authorization restricts access to users requiring the ability to make process inquiries. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). c) If (b) is true, there is NO FINDING. d) If (b) is untrue, this is a FINDING.

Fix: F-18852r1_fix

For all process resources (i.e., ssid.processname) defined to MQPROC resource class, ensure access authorization restricts access to users requiring the ability to make process inquiries. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). The following is a sample of the commands required to allow a user (USER1) to inquire on processes beginning with the letter V on queue manager (QM1): TSS ADD(USER1) FAC(QM1MSTR) TSS PER(USER1) MQPROC(QM1.V) ACC(READ) ACTION(AUDIT)

b
WebSphere MQ Namelist resources are not protected in accordance with security requirements.
AC-3 - Medium - CCI-000213 - V-6967 - SV-7549r3_rule
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
ZWMQ0056
Vuln IDs
  • V-6967
Rule IDs
  • SV-7549r3_rule
WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.Information Assurance Officer
Checks: C-4668r1_chk

a) Refer to the following report produced by the TSS Data Collection: - SENSITVE.RPT(WHOHMNLI) b) For all namelist resources (i.e., ssid.namelist) defined to MQNLIST resource class, ensure access authorization restricts access to users requiring the ability to make namelist inquiries. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). c) If (b) is true, there is NO FINDING. d) If (b) is untrue, this is a FINDING.

Fix: F-18853r1_fix

For all namelist resources (i.e., ssid.namelist) defined to MQNLIST resource class, ensure access authorization restricts access to users requiring the ability to make namelist inquiries. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). The following is a sample of the commands required to allow a user (USER1) to inquire on namelist TST1 on queue manager (QM1): TSS ADD(USER1) FAC(QM1MSTR) TSS PER(USER1) MQNLIST(QM1.TST1.) ACC(READ) ACTION(AUDIT)

b
WebSphere MQ alternate user resources defined to MQADMIN resource class are not protected in accordance with security requirements.
AC-3 - Medium - CCI-000213 - V-6969 - SV-7551r3_rule
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
ZWMQ0057
Vuln IDs
  • V-6969
Rule IDs
  • SV-7551r3_rule
WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.Information Assurance Officer
Checks: C-4671r1_chk

a) Refer to the following report produced by the TSS Data Collection: - SENSITVE.RPT(WHOHMADM) b) For all alternate user resources (i.e., ssid.ALTERNATE.USER.alternatelogonid) defined to MQADMIN resource class, ensure access authorization restricts access to users requiring the ability to use the alternate userid. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). c) If (b) is true, there is NO FINDING. d) If (b) is untrue, this is a FINDING.

Fix: F-18854r1_fix

For all alternate user resources (i.e., ssid.ALTERNATE.USER.alternateuserid) defined to MQADMIN resource class, ensure access authorization restricts access to users requiring the ability to use the alternate userid. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). The following is a sample of the commands required to allow payroll server (PAYSRV1) to specify alternate userids starting with the characters PS on queue manager (QM1): TSS ADD(USER1) FAC(QM1MSTR) TSS PER(USER1) MQADMIN(QM1.ALTERNATE.USER.PS) ACC(UPDATE) ACTION(AUDIT)

b
WebSphere MQ context resources defined to the MQADMIN resource class are not protected in accordance with security requirements.
AC-3 - Medium - CCI-000213 - V-6971 - SV-7553r3_rule
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
ZWMQ0058
Vuln IDs
  • V-6971
Rule IDs
  • SV-7553r3_rule
WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.Information Assurance Officer
Checks: C-4674r1_chk

a) Refer to the following report produced by the TSS Data Collection: - SENSITVE.RPT(WHOHMADM) b) For all context resources (i.e., ssid.CONTEXT) defined to the MQADMIN resource class, ensure access authorization restricts access to users requiring the ability to pass or set identity and/or origin data for a message. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). c) If (b) is true, there is NO FINDING. d) If (b) is untrue, this is a FINDING.

Fix: F-18855r1_fix

For all context resources (i.e., ssid.CONTEXT) defined to the MQADMIN resource class, ensure access authorization restricts access to users requiring the ability to pass or set identity and/or origin data for a message. This is difficult to determine. However, an item for concern may be a profile with * READ specified in the access list. NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). The following is a sample of the commands required to allow a systems programming group (SYS1) to offload and reload messages for queue manager (QM1): TSS ADD(SYS1) FAC(QM1MSTR) TSS PER(SYS1) MQADMIN(QM1.CONTEXT) ACC(UPDATE) ACTION(AUDIT)

b
WebSphere MQ command resources defined to MQCMDS resource class are not protected in accordance with security requirements.
AC-3 - Medium - CCI-000213 - V-6973 - SV-7555r3_rule
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
ZWMQ0059
Vuln IDs
  • V-6973
Rule IDs
  • SV-7555r3_rule
WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.Information Assurance Officer
Checks: C-20895r1_chk

a) Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(WHOHMCMD) b) For all command resources (i.e., ssid.command) defined to MQCMDS resource class, ensure the following items are in effect: NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). 1) Access authorization restricts access to the appropriate personnel as designated in the Websphere MQ COMMAND SECURITY CONTROLS Table in the z/OS STIG Addendum. 2) All command access is logged as designated in the Websphere MQ COMMAND SECURITY CONTROLS Table in the z/OS STIG Addendum. c) If both of the items in (b) are true, there is NO FINDING. d) If either item in (b) is untrue, this is a FINDING.

Fix: F-18856r1_fix

Command security validates userids authorized to issue MQSeries/WebSphere MQ commands. Command security will be active, and all profiles will be defined to the MQCMDS class. For all command resources (i.e., ssid.command) defined to MQCMDS resource class, ensure the following items are in effect: NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). 1) Access authorization restricts access to the appropriate personnel as designated in the table entitled "Websphere MQ Command Security Controls " in the zOS STIG Addendum. 2) All command access is logged as designated in the table entitled "Websphere MQ Command Security Controls " in the zOS STIG Addendum. The following is a sample of the commands required to allow a systems programming group (SYS1) to issue the command CLEAR QLOCAL in subsystem QM1: TSS ADD(SYS1) FAC(QM1MSTR) TSS PER(SYS1) MQCMDS(QM1.CLEAR.LOCAL) ACC(ALTER) ACTION(AUDIT)

b
WebSphere MQ RESLEVEL resources in the MQADMIN resource class are not protected in accordance with security requirements.
AC-3 - Medium - CCI-000213 - V-6975 - SV-7557r3_rule
RMF Control
AC-3
Severity
Medium
CCI
CCI-000213
Version
ZWMQ0060
Vuln IDs
  • V-6975
Rule IDs
  • SV-7557r3_rule
WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.Information Assurance Officer
Checks: C-4680r1_chk

a) Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(WHOHMADM) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZWMQ0060) b) Access authorization to these RESLEVEL resources restricts all access. No users are permitted access to ssid.RESLEVEL resources in the MQADMIN resource class. NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). c) If (b) is true, there is NO FINDING. d) If (b) is untrue, this is a FINDING.

Fix: F-18857r1_fix

RESLEVEL security profiles control the number of userids checked for API resource security. RESLEVEL security will not be implemented due to the following exposures and limitations: (1) RESLEVEL is a powerful option that can cause the bypassing of all security checks. (2) Security audit records are not created when the RESLEVEL profile is utilized. (3) If the WARNING option is specified on a RESLEVEL profile, no warning messages are produced. In order to protect against any profile in the MQADMIN class, such as ssid.**, resolving to a RESLEVEL profile, an ssid.RESLEVEL permission will be created for each queue manager with an access of none. The following sample command prevents access to ssid.RESLEVEL: TSS PER(ALL) MQADMIN(ssid.RESLEVEL) ACCESS(NONE)

b
WebSphere MQ channel security is not implemented in accordance with security requirements.
SC-23 - Medium - CCI-002470 - V-6980 - SV-111901r1_rule
RMF Control
SC-23
Severity
Medium
CCI
CCI-002470
Version
ZWMQ0012
Vuln IDs
  • V-6980
Rule IDs
  • SV-111901r1_rule
WebSphere MQ channel security can be configured to provide authentication, message privacy, and message integrity between queue managers. WebSphere MQ channels use SSL encryption techniques, digital signatures and digital certificates to provide message privacy, message integrity and mutual authentication between clients and servers. Failure to properly secure a WebSphere MQ channel may lead to unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of some system services, applications, and customer data.Information Assurance Officer
Checks: C-21007r1_chk

a) Refer to the following report produced by the z/OS Data Collection: - MQSRPT(ssid) NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). To determine which Release of WebSphere MQ, review ssid reports for message CSQU000I. Collect the following Information for Websphere MQ queue manager - If a WebSphere MQ queue manager communicates with a MQSeries queue manager, provide the WebSphere MQ queue manager and channel names used to connect with MQSeries. - If any WebSphere MQ channels are used to communicate within the enclave, provide a list of channels and provide documentation regarding the sensitivity of the information on the channel. b) Review the ssid report(s) and perform the following steps: 1) Find the DISPLAY QMGR SSLKEYR command to locate the start of the Queue Manager definitions. 2) Verify that each WebSphere MQ 5.3 queue manager is using a digital certificate by reviewing the SSLKEYR parameter to ensure that a keyring is identified. i.e. SSLKEYR(sslkeyring-id) 3) Issue the following TSS commands, where ssidCHIN is the Acid for the WebSphere MQ Channel Initiator’s userid and sslkeyring-id is obtained from the above action: TSS LIST(ssidCHIN) KEYRING(sslkeyring-id) NOTE: The sslkeyring-id is case sensitive. In the output find the DIGICERT field for ACID(ssidCHIN). Use this DIGICERT in the following command: TSS LIST(ssidCHIN) DIGICERT(digicert) NOTE: The digicert is case sensitive. Review the ISSUER DISTINGUISHED NAME field in the resulting output for information of any of the following: OU=PKI.OU=DoD.O=U.S. Governmemt.C=US OU=ECA.O=U.S. Government.C=US 4) Repeat these steps for each queue manager ssid identified. c) If the all of the items in (b) above are true, there is NO FINDING. d) If any of the items in (b) above are untrue, this is a FINDING.

Fix: F-18970r1_fix

Refer to the following report produced by the z/OS Data Collection: - MQSRPT(ssid) NOTE: ssid is the queue manager name (a.k.a., subsystem identifier). 1) Find the DISPLAY QMGR SSLKEYR command to locate the start of the Queue Manager definitions. 2) Verify that each WebSphere MQ queue manager is using a digital certificate by reviewing the SSLKEYR parameter to ensure that a keyring is identified. i.e. SSLKEYR(sslkeyring-id) 3) Issue the following TSS commands, where ssidCHIN is the lid for the WebSphere MQ Channel Initiator’s userid and sslkeyring-id is obtain from the above action: TSS LIST(ssidCHIN) KEYRING(sslkeyring-id) NOTE: The sslkeyring-id is case sensitive. In the output find the DIGICERT field for ACID(ssidCHIN). Use this DIGICERT in the following command: TSS LIST(ssidCHIN) DIGICERT(digicert) NOTE: The Certificate Label Name is case sensitive. Review the Issuer’s Name field in the resulting output for information of any of the following: OU=PKI.OU=DoD.O=U.S. Governmemt.C=US OU=ECA.O=U.S. Government.C=US 4) Repeat these steps for each queue manager ssid identified. To implement the requirements stated above, the following two items are provided which attempt to assist with (1) Technical "how to" information and (2) A DISA Point of contact for obtaining SSL certificates for CSD WebSphere MQ channels: 1. Review the information available on setting up SSL, Keyrings, and Digital Certificates in the CA TSS Cookbook regarding usage of the TSS commands to administer PKI Certificates as well as the WebSphere MQ Security manual. Also review the information contained in the documentation provided as part of the install package from the DISA SSO Resource Management Factory (formerly Software Factory). 2. For information on obtaining an SSL certificate in the DISA CSD environment, send email inquiry to [email protected] for more info.

b
Production WebSphere MQ Remotes must utilize Certified Name Filters (CNF)
CM-6 - Medium - CCI-000366 - V-31561 - SV-41848r5_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
ZWMQ0014
Vuln IDs
  • V-31561
Rule IDs
  • SV-41848r5_rule
IBM Websphere MQ can use a user ID associated with an ACP certificate as a channel user ID. When an entity at one end of an SSL channel receives a certificate from a remote connection, the entity asks The ACP if there is a user ID associated with that certificate. The entity uses that user ID as the channel user ID. If there is no user ID associated with the certificate, the entity uses the user ID under which the channel initiator is running. Without a validly defined Certificate Name Filter for the entity IBM Websphere MQ will set the channel user ID to the default.
Checks: C-40336r11_chk

Validate that the list of all Production WebSphere MQ Remotes exist, and contains approved Certified Name Filters and associated USERIDS. If the filter(s) is (are) defined, accurate and has been approved by Vulnerability ICER0030 and the associated USERID(s) is only granted need to know permissions and authority to resources and commands, this is not a finding. If there is no Certificate Name Filter for WebSphere MQ Remotes this is a Finding. Note: Improper use of CNF filters for MQ Series will result in the following Message ID. CSQX632I found in the following example: CSQX632I csect-name SSL certificate has no associated user ID, remote channel channel-name – channel initiator user ID used

Fix: F-3836r4_fix

The responsible MQ System programmer(s) shall create and maintain a spread sheet that contains a list of all Production WebSphere MQ Remotes, associated individual USERIDs with corresponding valid Certified Name Filters (CNF). This documentation will be reviewed and validated annually by responsible MQ System programmer(s) and forwarded for approval by the ISSM. The ISSO will define the associated USERIDs, the CNF, and grant the minimal need to know access, by granting only the required resources and Commands for each USERID in the ACP. See IBM WebSphere MQ Security manual for details on defining CNF for WebSphere MQ. Generic access shall not be granted such as resource permission at the SSID. MQ resource level.