What changed in z/OS CL/SuperSession for TSS STIG V7R2V7R2 changes

Check text

a) The following steps are necessary for reviewing the CL/SuperSession options: 1) Request on-lineonline access from the site administrator to view CL/SuperSession parameter settings. 2) Once access to the CL/SuperSession Main Menu has been obtained, select the option for the ADMINISTRATOR menu. 3) From the ADMINISTRATOR menu, select the option for the PROFILE SELECTION menu. 4) From the PROFILE SELECTION menu, select the View GLOBAL Profile option. 5) After selection of the View GLOBAL Profile option, the Update GLOBAL Profile menu appears. From this menu select the profile to be reviewed: - To view the Common profile, select: _Common - To view the SUPERSESSION profile, select: _SupSess Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(ZCLS0040). b) Compare the security parameters as specified in the Required CL/SuperSession Common Profile Options and Required CL/SuperssionSuperSession Profile Options Tables in the z/OS STIG Addendum against the CL/SuperSessionsettings Profile options. c) If all options as specified in the Required CL/SuperSession Common Profile Options and Required CL/Superssion Profile Options Tables in the z/OS STIG Addendum are in effect, there is no finding. d) If anyall of the options as specified in the Required CL/SuperSession Common Profile Options and Required CL/SuperssionSuperSession Profile Options Tables in the z/OS STIG Addendum isare not in effect, this is not a finding.

V-224649 in V7R2

Check text

a) Version 3 of CL/SuperSession Review the member KLKINNAF in the TLVPARM DD statement concatenation of the CL/SuperSession STC procedure to determine SMF number. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.) Version 2 of CL/SuperSession Review the member KLVINNAF in the TLVPARM DD statement concatenation of the CL/SuperSession STC procedure to determine SMF number. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.) Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(SMFOPTS). Automated Analysis (Currently there is no automation for version 3 of CL/SuperSession) Refer to the following report produced by the z/OS Data Collection: - PDI(ZCLS0041). b) If the SMF= field specifies an SMF record number, reviewand the SMFOPTS report tospecifies verify SMF is writing that record type. c) If SMF is writing the record number specified by SMF=, therethis is no finding. d) If the SMF= field does not specify an SMF record number, or SMF is not writing the record number specified by SMF=, this is a finding.

V-224650 in V7R2

Check text

a) Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(KLSRPT) . Automated Analysis: Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZCLS0000). b) Verify that access to the CL/SuperSession Install data sets are properly restricted. If the following guidance is true, this is not a finding. ___ The TSS data set rules for the data sets does not restrict UPDATEWRITE and/or ALTERgreater access to systems programming personnel. ___ The TSS data set rules for the data sets does not specify that all (i.e., failures and successes) UPDATEWRITE and/or ALTERgreater access will be logged. c) If all of the above are untrue, there is no finding. d) If any of the above is true, this is a finding.

Fix text

Ensure that updateWRITE and/or allocategreater access to CL/SuperSession install data sets are limited to systems programmers only, and all updateWRITE and/or allocategreater access is logged. The installing systems programmer will identify and document the product data sets and categorize them according to who will have updateWRITE and/or altergreater access and if required that all updateWRITE and/or allocategreater access is logged. The installing systems programmer will identify if any additional groups have updateUPDATE access for specific data sets and, once documented, will work with the ISSO to seeensure that they are properly restricted to the ACP (Access Control Program ) active on the system. The following are an example of data sets to be protected: sys2.omegamon. sys2.omegamon.*.tlsload sys2.omegamon.*.tlvload sys3.omegamon. sys3.omegamon.rlsload The following commands are provided as an example for implementing datasetdata set controls: TSS PERMIT(syspaudt) DSN(sys2.omegamon.) ACCESS(r) TSS PERMIT(syspaudt) DSN(sys2.omegamon.) ACCESS(all) ACTION(audit) TSS PERMIT(syspaudt) DSN(sys2.omegamon.*.tlsload) ACCESS(r) TSS PERMIT(syspaudt) DSN(sys2.omegamon.*.tlsload) ACCESS(all) ACTION(audit) TSS PERMIT(syspaudt) DSN(sys2.omegamon.*.tlvload) ACCESS(r) TSS PERMIT(syspaudt) DSN(sys2.omegamon.*.tlvload) ACCESS(all) ACTION(audit) TSS PERMIT(syspaudt) DSN(sys3.omegamon.) ACCESS(r) TSS PERMIT(syspaudt) DSN(sys3.omegamon.) ACCESS(all) ACTION(audit) TSS PERMIT(syspaudt) DSN(sys3.omegamon.*.rlsload) ACCESS(r) TSS PERMIT(syspaudt) DSN(sys3.omegamon.*.rlsload) ACCESS(all) ACTION(audit)

V-224651 in V7R2

Check text

Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(KLSSTC). Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZCLS0001). Verify that the accesses to the CL/SuperSession STC data sets are properly restricted. If the following guidance is true, this is not a finding. ___ The TSS data set access authorizations restrict READ access to auditors and authorized users. ___ The TSS data set access authorizations restrict WRITE and/or greater access to systems programming personnel. ___ The TSS data set rules for the data sets does not restrict WRITE and/or greater access to the product STC(s) and/or batch job(s).

Fix text

Ensure that WRITE and/or greater access to CL/SuperSession STC data sets are limited to systems programmers and CL/SuperSession STC only. ReadREAD access can be given to auditors and authorized users. The installing systems programmer will identify and document the product data sets and categorize them according to who will have WRITE and/or greater access and if required that all WRITE and/or greater access is logged. The installing systems programmer will identify if any additional groups have WRITE and/or greater access for specific data sets, and once documented will work with the ISSO to ensure they are properly restricted to the ACP (Access Control Program (ACP) active on the system. Note: The data sets and/or data set prefixes identified below are examples of a possible installation. The actual data sets and/or prefixes are determined when the product is actually installed on a system through the product's installation guide and can be site specific. The following are an example of data sets to be protected: SYS3.OMEGAMON.RLSNAF SYS3.OMEGAMON.RLSNAM SYS3.OMEGAMON.RLSTDB SYS3.OMEGAMON.RLSVLOG The following commands are provided as an example for implementing datasetdata set controls: TSS PERMIT(syspaudt) DSN(sys3.omegamon.rlsnaf) ACCESS(ALL) TSS PERMIT(kls) DSN(sys3.omegamon.rlsnaf) ACCESS(ALL) TSS PERMIT(audtaudt) DSN(sys3.omegamon.rlsnaf) ACCESS(READ) TSS PERMIT(all) DSN(sys3.omegamon.rlsnaf) ACCESS(READ) TSS PERMIT(syspaudt) DSN(sys3.omegamon.rlsnam) ACCESS(ALL) TSS PERMIT(kls) DSN(sys3.omegamon.rlsnam) ACCESS(ALL) TSS PERMIT(audtaudt) DSN(sys3.omegamon.rlsnam) ACCESS(READ) TSS PERMIT(all) DSN(sys3.omegamon.rlsnam) ACCESS(READ) TSS PERMIT(syspaudt) DSN(sys3.omegamon.rlstdb) ACCESS(ALL) TSS PERMIT(kls) DSN(sys3.omegamon.rlstdb) ACCESS(ALL) TSS PERMIT(audtaudt) DSN(sys3.omegamon.rlstdb) ACCESS(READ) TSS PERMIT(all) DSN(sys3.omegamon.rlstdb) ACCESS(READ) TSS PERMIT(syspaudt) DSN(sys3.omegamon.rlsvlog) ACCESS(ALL) TSS PERMIT(kls) DSN(sys3.omegamon.rlsvlog) ACCESS(ALL) TSS PERMIT(audtaudt) DSN(sys3.omegamon.rlsvlog) ACCESS(READ) TSS PERMIT(all) DSN(sys3.omegamon.rlsvlog) ACCESS(READ)

V-224652 in V7R2

Title

CL/SuperSession Started Task name is not properly identified / defined to the system ACP.

Check text

a) Refer to the following reportsreport produced by the TSS Data Collection: - TSSCMDS.RPT(@ACIDS). b) Review the CL/SuperSession STC/Batch ACID(s). forIf the following: ___ Is attributes are defined, asthis KLSis fornot thea ACIDfinding. ___ Is defined with Facility of FACILITY(STC, and/or BATCH.) PASSWORD(xxxxxxxx,0) ___ Is defined with Master Facility of KLS. ___ Is sourced to the SOURCE(INTRDR. c) If all of the above are true, there is NO FINDING. NOSUSPEND dMASTFAC(KLS) If any of the above is untrue, this is a FINDING.

Fix text

The Systems Programmer and IAOISSO will ensure that the started task for CL/SuperSession is properly defined. Review all session manager security parameters and control options for compliance. Develop a plan of action and implement the changes as specified. Define the started task userid KLS for CL/SuperSession. Example: TSS CRE(KLS) DEPT(Dept) NAME('CL/SuperSession STC') - FAC(STC) MASTFAC(KLS) PASSWORD(password,0) - SOURCE(INTRDR) NOSUSPEND

Discussion

CL/SuperSession requires a started task that will be restricted to certain resources, datasetsdata sets, and other system functions. ByDefining defining the started task as a userid to the system ACP, It allows the ACP to control the access and authorized users that require these capabilities. Failure to properly control these capabilities, could compromise of the operating system environment, ACP, and customer data.

V-224653 in V7R2

Check text

Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(#STC). Automated Analysis Refer to the following report produced by the TSS Data Collection: - PDI(ZCLS0032). VerifyIf that the CL/SuperSession started task(s) is (are) defined in the TSS STC record, this is not a finding.

Fix text

The CL/SuperSession systemsystems programmer and the IAOISSO will ensure that a product's started task(s) is (are) properly identified and/or defined to the Systemsystem ACP. A unique ACID must be assigned for the CL/SuperSession started task(s) thruthrough a corresponding STC table entry. The following sample set of commands is shown here as a guideline: TSS ADD(STC) PROCNAME(KLS) ACID(KLS)

Discussion

Access to product resources should be restricted to only those individuals responsible for the application connectivity and who have a requirement to access these resources. Improper control of product resources could potentially compromise the operating system, ACP, and customer data.

V-224654 in V7R2

Check text

a) Refer to the following reportreports produced by the TSS Data Collection: - TSSCMDS.RPT(FACLIST) - Preferred report containing all control option values in effect including default values. - TSSCMDS.RPT(TSSPRMFL) - Alternate report containing only control option values explicitly coded at TSS startup. b) If KLS is properly defined in the CL/SuperSession Facility Matrix table, there is NO FINDING: c) If KLS is improperly defined inas thestated Facility Matrix tablebelow, this is not a FINDINGfinding. *KLS CL/SUPERSESSION FACILITY(USERxx=NAME=KLS) FACILITY(KLS=MODE=FAIL,ACTIVE,SHRPRF) FACILITY(KLS=PGM=KLV,NOASUBM,NOABEND,NOXDEF) FACILITY(KLS=ID=xx,MULTIUSER,RES,LUMSG,STMSG,WARNPW,SIGN(M)) FACILITY(KLS=NOINSTDATA,NORNDPW,AUTHINIT,NOPROMPT,NOAUDIT) FACILITY(KLS=NOTSOC,LOG(INIT,SMF,MSG,SEC9))

V-224655 in V7R2

Check text

a) Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(#RDT). b) If the resource class of KLS is defined, therein is NO FINDING. c) If the resourceResource classDefinition ofTable KLS is not defined(RDT), this is not a FINDINGfinding.

Fix text

Add the resource KLS to the TOP SECRET RDT using the following TSS command example: TSS ADD(RDT) RESCLASS(KLS) RESCODE(xx) (where xx is an unused hex value)

V-224656 in V7R2

Check text

Version 3 of CL/SuperSession Review the member KLKINNAM in the TLVPARM DD statement concatenation of the CL/SuperSession STC procedure. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.) Version 2 of CL/SuperSession Review the member KLVINNAM in the TLVPARM DD statement concatenation of the CL/SuperSession STC procedure. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.) Automated Analysis (Currently there is no automation for version 3 of CL/SuperSession) Refer to the following report produced by the z/OS Data Collection: - PDI(ZCLS0042). If one of the following configuration settings is specified for each control point defined in the KLKINNAM member for version 3 of CL/SuperSession or KLVINNAM member for version 2 of CL/SuperSession, this is not a finding. DEFAULT DSNAME(SYS3.OMEGAMON.qualifier.RLSNAM) - RACF - CLASSES=APPCLASS - NODB - EXIT=KLSTSNEV (The following is for z/OS CAC logon processing) DEFAULT DSNAME(SYS3.OMEGAMON.qualifier.RLSNAM) - SAF - CLASSES=APPCLASS - NODB - EXIT=KLSNFPTX or KLSTSPTX

V-224657 in V7R2

Check text

a) Review the member APPCLASS in the TLVPARM DD statement concatenation of the CL/Supersession STC procedure. (This member is located in SYS3.OMEGAMON.qualifier.RLSPARM.) Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(ZCLS0043). b) If the parameters for the member APPCLASS are configured as follows, therethis is nonot a finding:. VGWAPLST EXTERNAL=KLS c) If the parameters for the member APPCLASS are not configured as specified in (b) above, this is a finding.

V-224658 in V7R2