Verify that access to the zSecure STC data sets is properly restricted.
If the following guidance is true, this is not a finding.
- The RACF profiles protecting zSecure STC data sets do not allow general access by means of UACC, ID(*), WARNING, or global access.
- READ and higher access to zAlert CKFREEZE data sets is restricted to trusted STC users and systems programmers.
- READ access to Access Monitor output data sets is restricted to auditors, decentralized security administrators, security administrators, automated operation STCs/batch jobs, batch jobs performing ESM maintenance, trusted STC users, and systems programmers.
- UPDATE access to Access Monitor output data sets is restricted to automated operation STCs/batch jobs, batch jobs performing ESM maintenance, trusted STC users, and systems programmers.
- CONTROL and higher access to Access Monitor output data sets is restricted to trusted STC users and systems programmers.
- All failures and successful UPDATE and higher access to zSecure STC data sets is logged.
DASD-only CKXLOG log stream resources in the LOGSTRM class:
- READ is restricted to security administrators, auditors, batch jobs performing ESM maintenance
- ALTER restricted to CKXLOG task, system programmers, and batch jobs performing ESM maintenance
* For Coupling-Facility CKXLOG log streams, the above applies in addition to checking the IXLSTR.model_structure_name profiles in the FACILITY class:
- UPDATE and higher trusted STC users, and systems programmers.