What changed in z/OS IBM Health Checker for TSS STIG V7R1V7R1 changes

Check text

Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(HCKSTC) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZHCK0001) Verify that the accesses to the IBM Health Checker STC data sets are properly restricted. If the following guidance is true, this is not a finding. ___ The TSS data set rules for the data sets restricts READ access to auditors. ___ The TSS data set rules for the data sets restricts WRITE and/or greater access to systems programming personnel. ___ The TSS data set rules for the data sets restricts WRITE and/or greater access to the IBM Health Checker's STC(s) and/or batch user(s).

V-224738 in V7R1

Title

IBM Health Checker Started Task name will be properly identified and/or defined to the system Access Control Program (ACP).

Check text

Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(@ACIDS) Verify that the ACID(s) for the IBM Health Checker started task(s) is (are) properly defined. If the following attributes are defined, this is not a finding. FACILITY(STC, BATCH) PASSWORD(xxxxxxxx,0) SOURCE(INTRDR) NOSUSPEND

Fix text

The IAOISSO working with the systems programmer will ensure the IBM Health Checker Started Task(s) is properly identified and/or defined to the System ACP. If the product requires a Started Task, verify that it is properly defined to the System ACP with the proper attributes. Most installation manuals will indicate how the Started Task is identified and any additional attributes that must be specified. The following commands are provided as a sample for defining Started Task(s): TSS CREATE(HZSPROD) TYPE(USER) - NAME('STC, IBM Health Checker') DEPT(xxxx) - FAC(STC,BATCH) PASS(xxxxxxxx,0) - SOURCE(INTRDR) NOSUSPEND

V-224739 in V7R1

Check text

Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(#STC) Automated Analysis Refer to the following report produced by the TSS Data Collection: - PDI(ZHCK0032) If the IBM Health Checker started task(s) is (are) defined in the TSS STC record, this is not a finding.

Fix text

The IAOISSO working with the systems programmer will ensure the IBM Health Checker Started Task(s) is properly identified and/or defined to the System ACP. A unique ACID must be assigned for the IBM Health Checker started task(s) thru a corresponding STC table entry. The following commands are provided as a sample for defining Started Task(s): TSS ADD(STC) PROCNAME(HZSPROC) ACID(HZSPROC)

Discussion

Access to product resources should be restricted to only those individuals responsible for the application connectivity and who have a requirement to access these resources. Improper control of product resources could potentially compromise the operating system, ACP, and customer data.

V-224740 in V7R1