What changed in z/OS CA VTAPE for RACF STIG V7R2V7R2 changes

Check text

Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(VTARPT). Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZVTA0000). Verify that the accesses to the CA VTAPE installation data sets are properly restricted. If the following guidance is true, this is not a finding. The RACF data set rules for the data sets restricts READ access to all authorized users. The RACF data set rules for the data sets restricts UPDATEWRITE and/or ALTERgreater access to systems programming personnel. The RACF data set rules for the data sets specify that all (i.e., failures and successes) UPDATEWRITE and/or ALTERgreater access are logged.

Fix text

The ISSO will ensure that updateWRITE and/or altergreater access to CA VTAPE installation data sets is limited to system programmers only, and all updateWRITE and/or altergreater access is logged. ReadREAD access can be given to all authorized users. The installing systems programmer will identify and document the product data sets and categorize them according to who will have updateWRITE and/or altergreater access and if required that all updateWRITE and/or altergreater access is logged. The installing systems programmer will identify if any additional groups have updateWRITE and/or altergreater access for specific data sets, and once documented, will work with the ISSO to ensure they are properly restricted to the Access Control Program (ACP) active on the system. Data sets to be protected will be: SYS2.VTAPE.** SYS3.VTAPE.** (data sets that are not altered by product STCs, can be more specific) The following commands are provided as a sample for implementing data set controls: ad 'SYS2.VTAPE.**' uacc(none) owner(sys2) - audit(success(update) failures(read)) - data('CA VTAPE Install DS') pe 'SYS2.VTAPE.**' id(&ltsyspaudt> &lttstcaudt>) acc(a) pe 'SYS2.VTAPE.**' id(&ltaudtaudt> authorized users) acc(r) pe 'SYS2.VTAPE.**' id(VTAPE STCs) ad 'SYS3.VTAPE.**' uacc(none) owner(sys3) - audit(success(update) failures(read)) - data('CA VTAPE Install DS') pe 'SYS3.VTAPE.**' id(&ltsyspaudt> &lttstcaudt>) acc(a) pe 'SYS3.VTAPE.**' id(&ltaudtaudt> authorized users) acc(r) pe 'SYS3.VTAPE.**' id(VTAPE STCs) setr generic(dataset) refresh

V-224444 in V7R2

Check text

Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(VTASTC). Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZVTA0001). Verify that the accesses to the CA VTAPE STC data sets are properly restricted. If the following guidance is true, this is not a finding. ___ The RACF data set rules for the data sets restricts READ access to auditors and authorized users. ___ The RACF data set rules for the data sets restricts WRITE and/or greater access to systems programming personnel and Tape Management personnel. ___ The RACF data set rules for the data sets restricts WRITE and/or greater access to the CA VTAPE's STC(s) and/or batch user(s). ___ The RACF data set rules for the data sets specify UACC(NONE) and NOWARNING.

Fix text

The ISSO will ensure that WRITE and/or greater access to CA VTAPE STC data sets is limited to systems programmers, Tape Management personnel and/or CA VTAPE's STC(s) and/or batch user(s) only. READ access can be given to auditors and authorized users. The installing systems programmer will identify and document the product data sets and categorize them according to who will have updateWRITE and/or altergreater access and if required that all updateWRITE and/or allocategreater access is logged. The installing systems programmer will identify if any additional groups have updateWRITE and/or altergreater access for specific data sets, and once documented will work with the ISSO to ensure they are properly restricted to the ACP (Access Control Program) active on the system. Data sets to be protected will be: SYS3.VTAPE (data sets that are altered by the product's STCs, this can be more specific) The following commands are provided as a sample for implementing data set controls: ad 'SYS3.VTAPE.**' uacc(none) owner(sys3) - audit(failures(read)) - data('Vendor DS Profile: CA VTAPE') pe 'SYS3.VTAPE.**' id(&ltsyspaudt> &lttstcaudt> VTAPE STCs) acc(a) pe 'SYS3.VTAPE.**' id(&lttapeaudt> VTAPE STCs) acc(a) pe 'SYS3.VTAPE.**' id(&ltaudtaudt> authorized users) acc(r) setr generic(dataset) refresh

V-224445 in V7R2

Check text

Refer to the following report produced by the RACF Data Collection: - RACFCMDS.RPT(LISTUSER). TheVerify that the userid(s) for the CA VTAPE started task(s) and/oris batch job userid(sare) isproperly defined. andIf isthe assignedfollowing theattributes RACFare PROTECTEDdefined, attributethis is not a finding. PROTECTED

Fix text

The CA VTAPE system programmer and the IAOISSO will ensure that a product's Started Task(s) is properly identified/defined to the System ACP. If the product requires a Started Task, verify that it is properly defined to the System ACP with the proper attributes. Most installation manuals will indicate how the Started Task is identified and any additional attributes that must be specified. A sample is provided here: au SVTS name('CA VTAPE') owner(stc) dfltgrp(stc) nopass au SVTSAS name('CA VTAPE') owner(stc) dfltgrp(stc) nopass

Discussion

CA VTAPE requires a started task that will be restricted to certain resources, datasetsdata sets, and other system functions. ByDefining defining the started task as a userid to the system ACP, It allows the ACP to control the access and authorized users that require these capabilities. Failure to properly control these capabilities, could compromise of the operating system environment, ACP, and customer data.

V-224446 in V7R2

Check text

Refer to the following report produced by the RACF Data Collection: - DSMON.RPT(RACSPT). Automated Analysis Refer to the following report produced by the RACF Data Collection: - PDI(ZVTA0032). Verify that the CA VTAPE started task(s) is (are) defined to the STARTED resource class profile and/or ICHRIN03 table entry, this is not a finding.

Fix text

The CA VTAPE system programmer and the IAOISSO will ensure that a product's started task(s) is (are) properly identified and/or defined to the System ACP. A unique userid must be assigned for the CA VTAPE started task(s) thru a corresponding STARTED class entry. The following sample set of commands is shown here as a guideline: rdef started SVTS.** uacc(none) owner(admin) audit(all(read)) stdata(user(SVTS) group(stc)) rdef started SVTSAS.** uacc(none) owner(admin) audit(all(read)) stdata(user(SVTSAS) group(stc)) setr racl(started) ref

Discussion

Access to product resources should be restricted to only those individuals responsible for the application connectivity and who have a requirement to access these resources. Improper control of product resources could potentially compromise the operating system, ACP, and customer data.

V-224447 in V7R2