What changed in z/OS CA Common Services for RACF STIG V7R2V7R2 changes

Check text

Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(CCSRPT). Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZCCS0000). Verify that the accesses to the CA Common Services installation data sets are properly restricted. If the following guidance is true, this is not a finding. ___ The RACF data set rules for the data sets restricts READ access to all authorized users. ___ The RACF data set rules for the data sets restricts WRITE and/or greater access to systems programming personnel. ___ The RACF data set rules for the data sets specify that all (i.e., failures and successes) WRITE and/or greater access is logged. ___ The RACF data set rules for the data sets specify UACC(NONE) and NOWARNING.

V-224433 in V7R2

Check text

Refer to the following report produced by the RACF Data Collection: - RACFCMDS.RPT(LISTUSER). Verify that the userid(s) for the CA Common Services started task(s) is (are) properly defined. If the following attributes are defined, this is not a finding. PROTECTED

Discussion

CA Common Services requires a started task that will be restricted to certain resources, datasetsdata sets, and other system functions. ByDefining defining the started task as a userid to the system ACP, It allows the ACP to control the access and authorized users that require these capabilities. Failure to properly control these capabilities, could compromise of the operating system environment, ACP, and customer data.

V-224434 in V7R2

Check text

Refer to the following report produced by the RACF Data Collection: - DSMON.RPT(RACSPT). Automated Analysis Refer to the following report produced by the RACF Data Collection: - PDI(ZCCS0032). If the CA Common Services started task(s) is (are) defined to the STARTED resource class profile and/or ICHRIN03 table entry, this is not a finding.

Discussion

Access to product resources shouldmust be restricted to only those individuals responsible for the application connectivity and who have a requirement to access these resources. Improper control of product resources could potentially compromise the operating system, ACP, and customer data.

V-224435 in V7R2