CA IDMS Security Technical Implementation Guide

The CA IDMS Security Technical Implementation Guide (V2 R2) has 74 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

74STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R2

CurrentPublished Wed Jul 01 2026 What changed in V2R2

IDMS must protect against the use of web-based applications that use generic IDs.

CA IDMS Security Technical Implementation Guide

Assessment Title

Rule Text

IDMS must protect against the use of web-based applications that use generic IDs.

Description

Discussion Text

Web-based applications that allow a generic ID can be a door into IDMS allowing unauthorized changes whose authors may not be determined.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-251597

Rule

SV-251597r960864_rule

Severity

low

Rule Version

IDMS-DB-000170

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

If there are web-based applications to which individual users sign on, and a generic ID associated with the application is used to access back-end IDMS databases, this is a finding.

Implementation Procedure

Fix Text

For web-based applications using generic IDs, set the individual user ID (external identity) to be recorded in the journal.

For JDBC applications, use the "IdmsConnection setIdentity" method.

For ODBC applications, use the "SQLSetConnectAttr" function with the IDMS_ATTR_EXTERNAL_IDENTITY attribute type.

Run journal report "JREPORT 010" and" JREPORT 008" to audit the individual user ID.

STIG check 16 of 74 in the CA IDMS STIG checklist

← Previous · V-251596IDMS must protect against the use of numbered exits that change the userid to a shared id.Next · V-251598 →IDMS must protect against the use web services that do not require a sign on when actions are performed that may be audited.