What changed in z/OS BMC MAINVIEW for z/OS for ACF2 STIG V7R2V7R2 changes

Title

BMC MAINVIEW for z/OS installation data sets are not properly protected.

Check text

Refer to the following report produced by the Datadataset Set and Resource Data Collection: - SENSITVE.RPT(MVZRPT). Automated Analysis Refer to the following report produced by the Datadataset Set and Resource Data Collection: - PDI(ZMVZ0000). Verify that the accesses to the BMC MAINVIEW for z/OS installation datadatasets sets are properly restricted. If the following guidance is true, this is not a finding. The ACF2 datadataset set rules for the datadatasets setsrestrict restricts READ access to all authorized users. The ACF2 datadataset set rules for the datadatasets setsrestrict restrictsWRITE UPDATE and/or ALTERgreater access to systems programming personnel. The ACF2 datadataset set rules for the datadatasets sets specify that all (i.e., failures and successes) UPDATEWRITE and/or ALTERgreater access areis logged.

Fix text

The ISSO will ensure that updateWRITE and/or allocategreater access to BMC MAINVIEW for z/OS installation datadatasets sets is limited to systemsystems programmers only, and all updateWRITE and/or allocategreater access is logged. Read READ access can be given to all authorized users. The installing systems programmer will identify and document the product datadatasets sets and categorize them according to who will have updateWRITE and/or altergreater access, and if required, that all updateWRITE and/or allocategreater access is logged. The programmer will identify if any additional groups have updateWRITE and/or altergreater access for specific data setsdatasets, and once documented, will work with the ISSO to ensure they are properly restricted to the Access Control Program (ACP) active on the system. DataDatasets sets to be protected will be: SYS2.BMCVIEW. SYS3.BMCVIEW. (dataDatasets sets that are not altered by product STCs, can be more specific.) The following commands are provided as a sample for implementing datadataset set controls: $KEY(SYS2) BMCVIEW.- UID(&ltsyspaudt>) R(A) W(L) A(L) E(A) BMCVIEW.- UID(&lttstcaudt>) R(A) W(L) A(L) E(A) BMCVIEW.- UID(&ltaudtaudt>) R(A) E(A) BMCVIEW.- UID(authorized users) R(A) E(A) BMCVIEW.- UID(&ltaudtaudt>) R(A) E(A) BMCVIEW.- UID(MAINVIEW STCs) R(A) E(A) $KEY(SYS3) BMCVIEW.- UID(&ltsyspaudt>) R(A) W(L) A(L) E(A) BMCVIEW.- UID(&lttstcaudt>) R(A) W(L) A(L) E(A) BMCVIEW.- UID(&ltaudtaudt>) R(A) E(A) BMCVIEW.- UID(authorized users) R(A) E(A) BMCVIEW.- UID(MAINVIEW STCs) R(A) E(A)

Discussion

BMC MAINVIEW for z/OS installation datadatasets sets have the ability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to these datadatasets sets could result in violating the integrity of the base product, which could result in compromising the operating system or sensitive data.

V-224250 in V7R2

Title

BMC MAINVIEW for z/OS STC data sets are not properly protected.

Check text

Refer to the following report produced by the Datadataset Set and Resource Data Collection: - SENSITVE.RPT(MVZSTC). Automated Analysis Refer to the following report produced by the Datadataset Set and Resource Data Collection: - PDI(ZMVZ0001). Verify that the accesses to the BMC MAINVIEW for z/OS STC datadatasets sets are properly restricted. If the following guidance is true, this is not a finding. ___ The ACF2 datadataset set rules for the datadatasets setsrestrict restricts READ access to auditors and authorized users. ___ The ACF2 datadataset set rules for the datadatasets setsrestrict restrictsWRITE UPDATE and/or ALTERgreater access to systems programming personnel. ___ The ACF2 datadataset set rules for the datadatasets setsrestrict restrictsWRITE UPDATE and/or ALTERgreater access to the BMC MAINVIEW for z/OS's STC(s) and/or batch user(s).

Fix text

The ISSO will ensure that updateWRITE and/or allocategreater access to BMC MAINVIEW for z/OS STC datadatasets sets is limited to systems programmers and/or BMC MAINVIEW for z/OS's STC(s) and/or batch user(s) only. ReadREAD access can be given to auditors and authorized users. The installing systems programmer will identify and document the product datadatasets, sets and categorize them according to who will have updateWRITE and/or altergreater access, and if required, ensure that all updateWRITE and/or allocategreater access is logged. The installing systems programmer will identify if any additional groups have updateWRITE and/or altergreater access for specific data setsdatasets, and once documented will work with the ISSO to ensure they are properly restricted to the ACP (Access Control Program) active on the system. DataDatasets sets to be protected will be: SYS3.BMCVIEW (dataDatasets sets that are altered by the product's STCs, this can be more specific.) The following commands are provided as a sample for implementing datadataset set controls: $KEY(SYS3) BMCVIEW.- UID(&ltsyspaudt>) R(A) W(A) A(A) E(A) BMCVIEW.- UID(&lttstcaudt>) R(A) W(A) A(A) E(A) BMCVIEW.- UID(MAINVIEW STCs) R(A) W(A) A(A) E(A) BMCVIEW.- UID(&ltaudtaudt>) R(A) E(A) BMCVIEW.- UID(authorize users) R(A) E(A)

Discussion

BMC MAINVIEW for z/OS STC datadatasets sets have the ability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to these datadatasets sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.

V-224251 in V7R2

Check text

Refer to the following report produced by the ACF2 Data Collection and Datadataset Set and Resource Data Collection: - SENSITVE.RPT(ZMVZ0020). - ACF2CMDS.RPT(RESOURCE) - Alternate report. Automated Analysis Refer to the following report produced by the Datadataset Set and Resource Data Collection: - PDI(ZMVZ0020). Verify that the accesses to resources and/or generic equivalent are properly restricted according to the requirements specified in BMC MAINVIEW Resources table in the z/OS STIG Addendum. If the following guidance is true, this is not a finding. The ACF2 resources are defined with a default access of PREVENT. The ACF2 resource access authorizations restrict access to the appropriate personnel.

Fix text

The ISSO will work with the systems programmer to verify that the following are properly specified in the Access Control Program (ACP). (Note: The resource type, resources, and/or resource prefixes identified below are examples of a possible installation. The actual resource type, resources, and/or prefixes are determined when the product is actually installed on a system through the product's installation guide and can be site specific.) Use BMC MAINVIEW Resources table in the z/OS STIG Addendum. This table lists the resources, access requirements, and logging requirement for BMC MAINVIEW. Ensure the guidelines for the resource type, resources, and/or generic equivalent specified in the z/OS STIG Addendum are followed. The ACF2 resources as designated in the above table are defined with a default access of PREVENT. The ACF2 resource access authorizations restrict access to the appropriate personnel as designated in the above table. The following commands are provided as a sample for implementing resource controls: $KEY(BBM) TYPE(BMV) ssid.CN UID(autoaudt) ALLOW ssid.CN UID(dasdaudt) ALLOW ssid.CN UID(mqsaaudt) ALLOW ssid.CN UID(Mainview STCs) ALLOW ssid.CN UID(mvzread) ALLOW ssid.CN UID(mvzupdt) ALLOW ssid.CN UID(pcspaudt) ALLOW ssid.CN UID(syspaudt) ALLOW - UID(*) PREVENT

Discussion

BMC MAINVIEW can run with sensitive system privileges, and potentially can circumvent system controls. Failure to properly control access to product resources could result in the compromise of the operating system environment, and compromise the confidentiality of customer data. Many utilities assign resource controls that can be granted to systemsystems programmers only in greater than read authority. Resources are also granted to certain nonsystems personnel with read only authority.

V-224252 in V7R2

Check text

Refer to the following report produced by the ACF2 Data Collection: - ACF2CMDS.RPT(ATTSTC). InsureEnsure that the logonids(s) for the BMC Mainview for z/OS started task(s) includes the following:. If the following attributes are defined, this is not a finding. STC NO-SMC

Discussion

BMC Mainview for z/OS requires a started task that will be restricted to certain resources, datasets, and other system functions. ByDefining defining the started task as a userid to the system ACP, It allows the ACP to control the access and authorized users that require these capabilities. Failure to properly control these capabilities, could compromise of the operating system environment, ACP, and customer data.

V-224253 in V7R2

Check text

Refer to the following report produced by the ACF2 Data Collection: - ACF2CMDS.RPT(ACFGSO). If the following GSO CLASMAP record entriesentry(ies) is (are) defined, this is not a finding. CLASMAP.class RESOURCE(class) RSRCTYPE(type) ENTITYLN(nn) Note: The site determines the appropriate three letter RSRCTYPE that is unique for Mainview. The ENTITYLN should be appropriate for the site's installation. If the following GSO SAFDEF record entries are defined this not a finding. INSERT SAFDEF.ssid ID(BBCS) MODE(GLOBAL)REP - RACROUTE(SUBSYS=ssid REQSTOR=-)

V-224254 in V7R2

Check text

Refer to the Configuration Location dataset and member specified in the z/OS Dialog Management Procedures for BMC MAINVIEW for z/OS. Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(ZMVZ0040). The following keywords will have the specified values in the BMC MAINVIEW for z/OS security parameter member:, this is not a finding. Statement(values) ESMTYPE(AUTO|ACF2)

V-224255 in V7R2