What changed in z/OS CL/SuperSession for ACF2 STIG V7R2V7R2 changes

Check text

a) The following steps are necessary for reviewing the CL/SuperSession options: 1) Request online access from the site administrator to view CL/SuperSession parameter settings. 2) Once access to the CL/SuperSession Main Menu has been obtained, select the option for the ADMINISTRATOR menu. 3) From the ADMINISTRATOR menu, select the option for the PROFILE SELECTION menu. 4) From the PROFILE SELECTION menu, select the View GLOBAL Profile option. 5) After selection of the View GLOBAL Profile option, the Update GLOBAL Profile menu appears. From this menu, select the profile to be reviewed: - To view the Common profile, select: _Common - To view the SUPERSESSION profile, select: _SupSess Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(ZCLS0040). b) Compare the security parameters as specified in the Required CL/SuperSession Common Profile Options and Required CL/SuperSession Profile Options Tables in the z/OS STIG Addendum against the CL/SuperSessionsettings Profile options. c) If all options as specified in the Required CL/SuperSession Common Profile Options and Required CL/SuperSession Profile Options Tables in the z/OS STIG Addendum are in effect, there is no finding. d) If anyall of the options as specified in the Required CL/SuperSession Common Profile Options and Required CL/SuperSession Profile Options Tables in the z/OS STIG Addendum isare not in effect, this is not a finding.

V-224282 in V7R2

Check text

a) Version 3 of CL/SuperSession Review the member KLKINNAF in the TLVPARM DD statement concatenation of the CL/SuperSession STC procedure to determine SMF number. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.) Version 2 of CL/SuperSession Review the member KLVINNAF in the TLVPARM DD statement concatenation of the CL/SuperSession STC procedure to determine SMF number. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.) Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(SMFOPTS). Automated Analysis (Currently there is no automation for version 3 of CL/SuperSession) Refer to the following report produced by the z/OS Data Collection: - PDI(ZCLS0041). b)If the following guidance is true, this is not a finding. If the SMF= field specifies an SMF record number, review the SMFOPTS report to verify SMF is writing that record type. c) If SMF is writing the record number specified by SMF=, therethis is no finding. d) If the SMF= field does not specify an SMF record number, or SMF is not writing the record number specified by SMF=, this is a finding.

Fix text

Ensure the Session Manager generates SMF records for audit trail and accounting reports. To provide an audit trail of user activity in CL/SuperSession, configure the Network Accounting Facility (NAF) to require SMF recording of accounting and audit data. Accounting to the journal datadataset set is optional at the discretion of the site. ToEnsure accomplishthat thisthe NAF parameter options for versionmember KLKINNAF for Version 3 of CL/SuperSession, configureor theKLVINNAF followingfor NAFVersion startup2 parameters in the KLKINNAF member of theCL/SuperSession RLSPARM initialization parameter library asare follows:coded to the below specifications. DSNAME= dsname - Name of the NAF journal data setdataset. Required only if the site is collecting accounting and audit data in the journal datadataset set in addition to the SMF data. MOD - If the journal datadataset set is used, this parameter should be set to ensure that logging data in the datadataset set is not overwritten. SMF=nnn - SMF record number. This field is mandatory to ensure that CL/SuperSession data is always written to the SMF files.

V-224283 in V7R2

Title

CL/SuperSession Install data sets must be properly protected.

Check text

a) Refer to the following report produced by the Datadataset Set and Resource Data Collection: - SENSITVE.RPT(KLSRPT) . Automated Analysis: Refer to the following report produced by the Datadataset Set and Resource Data Collection: - PDI(ZCLS0000). b) Verify that access to the CL/SuperSession Install datadatasets sets are properly restricted. If the following guidance is true, this is not a finding. ___ The ACF2 datadataset set rules for the datadatasets sets does not restrict UPDATEWRITE and/or ALTERgreater access to systems programming personnel. ___ The ACF2 datadataset set rules for the datadatasets setsdo does not specify that all (i.e., failures and successes) UPDATEWRITE and/or ALTERgreater access will be logged. c) If all of the above are untrue, there is no finding. d) If any of the above is true, this is a finding.

Fix text

Ensure that updateWRITE and/or allocategreater access to CL/SuperSession install datadatasets setsis are limited to systems programmers only, and all updateWRITE and/or allocategreater access is logged. Auditors should have READ access. The installing systems programmer will identify and document the product datadatasets, sets and categorize them according to who will have updateWRITE and/or altergreater access, and if required, ensure that all updateWRITE and/or allocategreater access is logged. The installing systems programmer will identify if any additional groups have updateUPDATE access for specific data setsdatasets, and once documented will work with the ISSO to seeensure that they are properly restricted to the ACP (Access Control Program ) active on the system. The following datasetdatasets are an example of datadatasets sets to be protected: SYS2.OMEGAMON SYS2.OMEGAMON.V-.TLSLOAD SYS2.OMEGAMON.V-.TLVLOAD SYS3.OMEGAMON SYS3.OMEGAMON.RLSLOAD The following commands are provided as an example for implementing dataset controls: $KEY(SYS2) OMEGAMON.- UID(syspaudt) R(A) W(L) A(L) E(A) OMEGAMON.V-.TLSLOAD UID(syspaudt) R(A) W(L) A(L) E(A) OMEGAMON.V-.TLVLOAD UID(syspaudt) R(A) W(L) A(L) E(A) OMEGAMON.- UID(audtaudt) R(A) E(A) $KEY(SYS3) OMEGAMON.- UID(syspaudt) R(A) W(L) A(L) E(A) OMEGAMON.RLSLOAD UID(syspaudt) R(A) W(L) A(L) E(A) OMEGAMON.- UID(audtaudt) R(A) E(A)

Discussion

CL/SuperSession Install datadatasets sets provide the capability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to their datadatasets sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.

V-224284 in V7R2

Title

CL/SuperSession STC data sets must be properly protected.

Check text

Refer to the following report produced by the Datadataset Set and Resource Data Collection: - SENSITVE.RPT(KLSSTC). Automated Analysis: Refer to the following report produced by the Datadataset Set and Resource Data Collection: - PDI(ZCLS0001). Verify that the accesses to the CL/SuperSession STC datadatasets sets are properly restricted. If the following guidance is true, this is not a finding. ___ The ACF2 datadataset set access authorizations restrict READ access to auditors and authorized users. ___ The ACF2 datadataset set access authorizations restrict WRITE and/or greater access to systems programming personnel. ___ The ACF2 datadataset set rules for the datadatasets sets does not restrict WRITE and/or greater access to the product STC(s) and/or batch job(s).

Fix text

Ensure that WRITE and/or greater access to CL/SuperSession STC datadatasets sets are limited to systemsystems programmers and CL/SuperSession STC only. ReadREAD access can be given to auditors and authorized users. The installing systems programmer will identify and document the product datadatasets, sets and categorize them according to who will have WRITE and/or greater access, and if required, ensure that all WRITE and/or greater access is logged. The installing systems programmer will identify if any additional groups have WRITE and/or greater access for specific data setsdatasets, and once documented will work with the ISSO to ensure they are properly restricted to the ACP (Access Control Program) active on the system. Note: The datadatasets sets and/or datadataset set prefixes identified below are examples of a possible installation. The actual datadatasets sets and/or prefixes are determined when the product is actually installed on a system through the product's installation guide and can be site specific. The following datasetdatasets are an example of datadatasets sets to be protected: SYS3.OMEGAMON.RLSNAF SYS3.OMEGAMON.RLSNAM SYS3.OMEGAMON.RLSTDB SYS3.OMEGAMON.RLSVLOG The following commands are provided as an example for implementing dataset controls: $KEY(SYS3) OMEGAMON.RLSNAF UID(*) R(A) E(A) OMEGAMON.RLSNAF UID(audtaudt) R(A) E(A) OMEGAMON.RLSNAF UID(syspaudt) R(A) W(A) A(A) E(A) OMEGAMON.RLSNAF UID(stc KLS) R(A) W(A) A(A) E(A) OMEGAMON.RLSNAM UID(*) R(A) E(A) OMEGAMON.RLSNAM UID(audtaudt) R(A) E(A) OMEGAMON.RLSNAM UID(syspaudt) R(A) W(A) A(A) E(A) OMEGAMON.RLSNAM UID(stc KLS) R(A) W(A) A(A) E(A) OMEGAMON.RLSTDB UID(*) R(A) E(A) OMEGAMON.RLSTDB UID(audtaudt) R(A) E(A) OMEGAMON.RLSTDB UID(syspaudt) R(A) W(A) A(A) E(A) OMEGAMON.RLSTDB UID(stc KLS) R(A) W(A) A(A) E(A) OMEGAMON.RLSVLOG UID(*) R(A) E(A) OMEGAMON.RLSVLOG UID(audtaudt) R(A) E(A) OMEGAMON.RLSVLOG UID(syspaudt) R(A) W(A) A(A) E(A) OMEGAMON.RLSVLOG UID(stc KLS) R(A) W(A) A(A) E(A)

Discussion

CL/SuperSession STC datadatasets sets provide the capability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to their datadatasets sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.

V-224285 in V7R2

Check text

a) Refer to the following report produced by the ACF2 Data Collection: - ACF2CMDS.RPT(ATTSTC). b) IfVerify that the logonid(s) for the CL/SUPERSESSION started task(s) includes MUSASS and NO-SMC, there is NO FINDING. c(are) If theproperly logoniddefined. forIf the CL/SUPERSESSIONfollowing startedattributes taskare does not include MUSASS and/or NO-SMCdefined, this is not a FINDINGfinding. STC MUSASS NO-SMC

Fix text

The Systemssystems Programmerprogrammer and IAOISSO will ensure that the started task for CL/SuperSession is properly defined. Review all session manager security parameters and control options for compliance. Develop a plan of action and implement the changes as specified. Define the started task userid KLS for CL/SuperSession. Example: INSERT KLS NAME(STC, CL/SuperSession) MUSASS NO-SMC STC

Discussion

CL/SuperSession requires a started task that will be restricted to certain resources, datasets, and other system functions. ByDefining defining the started task as a userid to the system ACP, It allows the ACP to control the access and authorized users that require these capabilities. Failure to properly control these capabilities, could compromise of the operating system environment, ACP, and customer data.

V-224286 in V7R2

Check text

Version 3 of CL/SuperSession Review the member KLKINNAM in the TLVPARM DD statement concatenation of the CL/SuperSession STC procedure. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.) Version 2 of CL/SuperSession Review the member KLVINNAM in the TLVPARM DD statement concatenation of the CL/SuperSession STC procedure. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.) Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(ZCLS0042). If one of the following configuration settings is specified for each control point defined in the KLKINNAM member for Versionversion 3 of CL/SuperSession or KLVINNAM member for Versionversion 2 of CL/SuperSession, this is not a finding. DEFAULT DSNAME(SYS3.OMEGAMON.qualifier.RLSNAM) - NORACF - CLASSES=APPCLASS - NODB - EXIT=KLSA2NEV (The following is for z/OS CAC logon processing) DEFAULT DSNAME(SYS3.OMEGAMON.qualifier.RLSNAM) - SAF - CLASSES=APPCLASS - NODB - EXIT=KLSSFPTX

Fix text

Ensure that the parameter options for member KLKINNAM for Version 3 of CL/SuperSession or KLVINNAM for Version 2 of CL/SuperSession are coded to the below specifications. (Note: The datadataset set identified below is an example of a possible installation. The actual datadataset set is determined when the product is actually installed on a system through the product's installation guide and can be site specific.) Review the member KLKINNAM or KLVINNAM in the TLVPARM DD statement concatenation of the CL/SuperSession STC procedure. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.) Ensure all session manager security parameters and control options are in compliance according to the following: DEFAULT DSNAME(SYS3.OMEGAMON.qualifier.RLSNAM) - NORACF - CLASSES=APPCLASS - NODB - EXIT=KLSA2NEV (The following is for z/OS CAC logon processing) DEFAULT DSNAME(SYS3.OMEGAMON.qualifier.RLSNAM) - SAF - CLASSES=APPCLASS - NODB - EXIT=KLSSFPTX

V-224287 in V7R2

Check text

a) Review the member APPCLASS in the TLVPARM DD statement concatenation of the CL/SuperSession STC procedure. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.) Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(ZCLS0043). b) If the parameters for the member APPCLASS are configured as follows, therethis is nonot a finding:. VGWAPLST EXTERNAL=APL c) If the parameters for the member APPCLASS are not configured as specified in (b) above, this is a finding.

V-224288 in V7R2