IBM zSecure Suite STIG

IBM zSecure Suite Security Technical Implementation Guide

The IBM zSecure Suite Security Technical Implementation Guide (V1 R3) has 11 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

11STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R3

CurrentPublished Wed Apr 02 2025

Access to IBM Security zSecure user data sets must be properly restricted and logged.

IBM zSecure Suite Security Technical Implementation Guide

Assessment Title

Rule Text

Access to IBM Security zSecure user data sets must be properly restricted and logged.

Description

Discussion Text

If zSecure were to allow inappropriate reading or updating of user data sets, sensitive information could be disclosed, or changes might result in incorrect results reported by the product. Only qualified and authorized individuals must be allowed to create, read, update, and delete zSecure user data sets.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-259730

Rule

SV-259730r1050750_rule

Severity

medium

Rule Version

ZSEC-00-000080

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Verify the accesses to the zSecure user data sets are properly restricted. If the following guidance is true, this is not a finding.

- The RACF profiles protecting zSecure user data sets do not allow general access by means of UACC, ID(*), WARNING, or global access.
- READ access to ASSERTION, CKFREEZE, and UNLOAD data sets is restricted to auditors, automated operation STCs/batch jobs, decentralized security administrators, security administrators, batch jobs performing ESM maintenance, system programmers and trusted STC users.
- UPDATE and higher access to ASSERTION, CKFREEZE, and UNLOAD data sets is restricted to decentralized security administrators, security administrators, batch jobs performing ESM maintenance, and system programmers.
- All failures and successful UPDATE and higher access to ASSERTION, CKFREEZE, and UNLOAD data sets is logged.
- READ access to Access Monitor output data sets is restricted to auditors, decentralized security administrators, security administrators, batch jobs performing ESM maintenance, automated operation STCs/batch jobs, and trusted STC users, and system programmers.
- UPDATE and higher access to the Access Monitor output data sets is restricted to automated operation STCs/batch jobs, batch jobs performing ESM maintenance, trusted STC users, and system programmers.
- All failed and all successful UPDATE and higher access to Access Monitor output data sets is logged.
- READ access to CKACUST and CKACUSV data sets is restricted to auditors, batch jobs that perform ESM maintenance, decentralized security administrators, security administrators, automated operation STCs/batch jobs, trusted STC users, and systems programmers.
- UPDATE access to CKACUST and CKACUSV data sets is restricted to decentralized security administrators, security administrators, automated operation STCs/batch jobs, batch jobs performing ESM maintenance, trusted STC users, and systems programmers.
- CONTROL and higher access to CKACUST and CKACUSV data sets is restricted to systems programmers.
- All failed and all successful UPDATE and higher access to CKACUST and CKACUSV data sets is logged.
- READ access to CKXLOG log stream is restricted to auditors, decentralized security administrators, security administrators, automated operation STCs/batch jobs, trusted STC users, and system programmers.
- UPDATE and higher access to CKXLOG log stream is restricted to automated operation STCs/batch jobs, trusted STC users, and system programmers.
- All failed access to CKXLOG log stream is logged.

Implementation Procedure

Fix Text

The following commands are provided as a RACF sample for implementing zSecure user data set controls. Convert these commands for any other ESM:

ad 'hlq.zsec.user.assert/ckfreeze/unload.dsn' uacc(none) owner(zSecure owner) - 
audit(success(update) failures(read))

pe 'hlq.zsec.user.assert/ckfreeze/unload.dsn' id(AUDTAUDT, AUTOAUDT, SECAAUDT, SECDAUDT, SECBAUDT, TSTCAUDT) access(READ)

pe 'hlq.zsec.user.assert/ckfreeze/unload.dsn' id(SECAAUDT, SECDAUDT, SECBAUDT, SYSPAUDT) access(ALTER) 

ad 'hlq.zsec.accmon.user.dsn' uacc(none) owner(zSecure owner) -
audit(success(update) failures(read))

pe 'hlq.zsec.accmon.user.dsn' id(AUDTAUDT, AUTOAUDT, SECAAUDT, SECDAUDT, SECBAUDT, TSTCAUDT) access(READ)

pe 'hlq.zsec.accmon.user.dsn' id(AUTOAUDT, SECBAUDT, TSTCAUDT, SYSPAUDT) access(ALTER)
ad ' hlq.zsec.user.ckcus*
audit(success(UPDATE) failures(READ))

pe 'hlq.zsec.user.ckcus*' id(AUDTAUDT, AUTOAUDT, SECAAUDT, SECDAUDT, SECBAUDT, TSTCAUDT) access(UPDATE)

pe 'hlq.zsec.user.ckcus*' id(SYSPAUDT) access(ALTER) 
rdef logstrm LSName uacc(none) owner(zSecure owner) - 
audit(success(UPDATE) failures(read))

pe LSName class(logstrm) id(AUDTAUDT, AUTOAUDT, SECAAUDT, SECDAUDT, TSTCAUDT, SYSPAUDT) access(READ) 
pe LSName class(logstrm) id(AUTOAUDT, TSTCAUDT, SYSPAUDT) access(ALTER)

STIG check 3 of 11 in the IBM zSecure Suite STIG checklist

← Previous · V-259729Access to IBM Security zSecure STC data sets must be properly restricted and logged.Next · V-259731 →Started tasks for IBM Security zSecure products must be properly defined.