What changed in z/OS NetView for TSS STIG V7R2V7R2 changes

Check text

Review the member CxxSTYLE in the DSIPARM DD statement concatenation of the NetView CNMPROC STC procedure. Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZNET0040). EnsureIf thatthe allfollowing NetViewkeywords configurationspecify requirementsthe arevalues specified.in If the followingNetView guidanceconfiguration is truerequirements, this is not a finding. Keyword Value SECOPTS.OPERSEC SAFCHECK|SAFDEF SECOPTS.CMDAUTH SAF.FAIL|SAF.table

V-225580 in V7R2

Check text

Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(NETVRPT). Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZNET0000). Verify that access to the NetView install data sets are properly restricted. If the following guidance is true, this is not a finding. The TSS data set rules for the data sets does not restrict UPDATEWRITE and/or ALTERgreater access to systems programming personnel. The TSS data set rules for the datasetsdata doessets do not specify that all (i.e., failures and successes) UPDATEWRITE and/or ALTERgreater access will be logged. If all of the above are untrue, this is not a finding. If any of the above is true, this is a finding.

Fix text

The ISSO will ensure that updateWRITE and/or allocategreater access to NetView install data sets is limited to systemsystems programmers only, and all updateWRITE and/or allocategreater access is logged. All other users can have readREAD access. The installing systems programmer will identify and document the product data sets and categorize them according to who will have updateWRITE and/or altergreater access and if required that all updateWRITE and/or allocategreater access is logged. The installing systems programmer will identify if any additional groups have updateUPDATE access for specific data sets, and once documented, will work with the ISSO to ensure they are properly restricted to the Access Control Program (ACP) active on the system. Data sets to be protected will be: SYS2.NETVIEW SYS2A.NETVIEW SYS3.NETVIEW The following commands are provided as a sample for implementing datasetdata set controls: TSS PERMIT(syspaudt) DSN(SYS2.netview.) ACCESS(r) TSS PERMIT(syspaudt) DSN(SYS2.netview.) ACCESS(all) ACTION(AUDIT) TSS PERMIT(syspaudt) DSN(SYS2a.netview.) ACCESS(r) TSS PERMIT(syspaudt) DSN(SYS2a.netview.) ACCESS(all) ACTION(AUDIT) TSS PERMIT(syspaudt) DSN(SYS3.netview.) ACCESS(r) TSS PERMIT(syspaudt) DSN(SYS3.netview.) ACCESS(all) ACTION(AUDIT)

V-225581 in V7R2

Check text

Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(NETVSTC). Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZNET0001). Verify that acess to the NetView STC data sets are properly restricted. If the following guidance is true, this is not a finding. ___ The TSS data set rules for the data sets restrictsrestrict READ access to auditors. ___ The TSS data set rules for the data sets restrictsrestrict UPDATEWRITE and/or ALLgreater access to systems programming personnel. ___ The TSS data set rules for the data sets restrictsrestrict UPDATEWRITE and/or ALLgreater access to the product STC(s) and/or batch job(s).

Fix text

The IAOISSO will ensure that updateWRITE and/or allocategreater access to NetView STC data sets are limited to Systemsystems Programmersprogrammers and NetView STC only, unless a letter justifying access is filed with the IAOISSO. Auditors should have READ access. The installing Systemssystems Programmerprogrammer will identify and document the product data sets and categorize them according to who will have updateWRITE and/or altergreater access and if required that all updateWRITE and/or allocategreater access is logged. HeThe installing systems programmer will identify if any additional groups have updateWRITE and/or altergreater access for specific data sets, and once documented he will work with the IAOISSO to seeensure that they are properly restricted to the ACP (Access Control Program (ACP) active on the system. Data sets to be protected will be: SYS3.NETVIEW.&ltsystemid>.* (VSAM data sets) The following commands are provided as a sample for implementing datasetdata set controls: TSS PERMIT(CNMPROC) DSN(SYS3.netview.&ltsystemid>.) ACCESS(R) TSS PERMIT(audtaudt) DSN(SYS3.netview.&ltsystemid>.) ACCESS(R) TSS PERMIT(syspaudt) DSN(SYS3.netview.&ltsystemid>.) ACCESS(R) TSS PERMIT(tstcpaudt) DSN(SYS3.netview.&ltsystemid>.) ACCESS(R) TSS PERMIT(CNMPROC) DSN(SYS3.netview.&ltsystemid>.) ACCESS(ALL) TSS PERMIT(syspaudt) DSN(SYS3.netview.&ltsystemid>.) ACCESS(ALL) TSS PERMIT(tstcaudt) DSN(SYS3.netview.&ltsystemid>.) ACCESS(ALL) The VSAM Dataset required for greater than readREAD access are: SYS3.NETVIEW.&ltsystemid>.AAUVSPL SYS3.NETVIEW.&ltsystemid>.AAUVSSL SYS3.NETVIEW.&ltsystemid>.BNJLGPR SYS3.NETVIEW.&ltsystemid>.BNJLGSE SYS3.NETVIEW.&ltsystemid>.BNJ36PR SYS3.NETVIEW.&ltsystemid>.BNJ36SE SYS3.NETVIEW.&ltsystemid>.DSIKPNL SYS3.NETVIEW.&ltsystemid>.DSILIST SYS3.NETVIEW.&ltsystemid>.DSILOGP SYS3.NETVIEW.&ltsystemid>.DSILOGS SYS3.NETVIEW.&ltsystemid>.DSISVRT SYS3.NETVIEW.&ltsystemid>.DSITRCP SYS3.NETVIEW.&ltsystemid>.DSITRCS SYS3.NETVIEW.&ltsystemid>.SDSIOPEN

V-225582 in V7R2

Check text

Refer to the following report produced by the TSS Data Collection and Data Set and Resource Data Collection: - SENSITVE.RPT(ZNET0020). Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZNET0020). When SECOPTS.OPERSEC=SAFPW is specified in ZNET0040, this is not applicable. Ensure that all NetView resources and/or generic equivalents are properly protected according to the requirements specified in the NetView Resources table in the z/OS STIG Addendum. If the following guidance is true, this is not a finding. The TSS resources and/or generic equivalents as designated in the above table are owned or DEFPROT is specified for the resource class. The TSS resource access authorizations restrict access to the appropriate personnel as designated in the above table.

V-225583 in V7R2

Title

NetView Started Task name(s) is not properly identified / defined to the system ACP.

Check text

a) Refer to the following reports produced by the TSS Data Collection: - TSSCMDS.RPT(@ACIDS). b) Review the NetView STC/Batch ACID(s). forIf the following: ___ Is definedattributes asare CNMPROC for the ACID. ___ Is defined, asthis CNMPSSIis fornot thea ACIDfinding. ___ BothFor are defined with Facility of CNMPROC FACILITY(STC, and/or BATCH.) PASSWORD(xxxxxxxx,0) ___ CNMPROC is defined with Master Facility of NETVIEW. ___ Both are sourced to the SOURCE(INTRDR.) NOSUSPEND cMASTFAC(NETVIEW) If For all of the above are trueCNMPSSI FACILITY(STC, there is NO FINDING.BATCH) PASSWORD(xxxxxxxx,0) dSOURCE(INTRDR) If any of the above is untrue, this is a FINDING. NOSUSPEND

Fix text

The Systems Programmer and IAOISSO will ensure that the started task(s) for NetView is properly defined. Define the started task userid CNMPROC and CNMPSSI for NetView. Example: TSS CRE(CNMPROC) DEPT(Dept) NAME('NetView') - FAC(STC) MASTFAC(NETVIEW) PASSWORD(password,0) - SOURCE(INTRDR) TSS CRE(CNMPSSI) DEPT(Dept) NAME('NetView') - FAC(STC) PASSWORD(password,0) - SOURCE(INTRDR)

Discussion

NetView requires a started task(s) that will be restricted to certain resources, datasetsdata sets, and other system functions. ByDefining defining the started task as a userid to the system ACP, It allows the ACP to control the access and authorized users that require these capabilities. Failure to properly control these capabilities, could compromise of the operating system environment, ACP, and customer data.

V-225584 in V7R2

Check text

Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(#STC). Automated Analysis Refer to the following report produced by the TSS Data Collection: - PDI(ZNET0032). VerifyIf that the IBM Tivoli NetView started task(s) is (are) defined in the TSS STC record, this is not a finding.

Fix text

The IBM Tivoli NetView systemsystems programmer and the IAOISSO will ensure that a product's started task(s) is (are) properly identified and/or defined to the Systemsystem ACP. A unique ACID must be assigned for the IBM Tivoli NetView started task(s) thruthrough a corresponding STC table entry. The following sample set of commands is shown here as a guideline: TSS ADD(STC) PROCNAME(CNMPROC) ACID(CNMPROC) TSS ADD(STC) PROCNAME(CNMPSSI) ACID(CNMPSSI)

Discussion

Access to product resources should be restricted to only those individuals responsible for the application connectivity and who have a requirement to access these resources. Improper control of product resources could potentially compromise the operating system, ACP, and customer data.

V-225585 in V7R2

Check text

a) Refer to the following reportreports produced by the TSS Data Collection: - TSSCMDS.RPT(FACLIST) - Preferred report containing all control option values in effect including default values. - TSSCMDS.RPT(TSSPRMFL) - Alternate report containing only control option values explicitly coded at TSS startup. b) If NETVIEW is properly defined in the NETVIEW Facility Matrix table, there is NO FINDING: c) If NETVIEW is improperly defined inas thestated Facility Matrix tablebelow, this is not a FINDINGfinding. FACILITY(USERxx=NAME=NETVIEW) FACILITY(NETVIEW=MODE=FAIL) FACILITY(NETVIEW=PGM=DSI) FACILITY(NETVIEW=ACTIVE,SHRPRF,ASUBM,ABEND,MULTIUSER,NOXDEF) FACILITY(NETVIEW=LUMSG,STMSG,SIGN(M),INSTDATA,NORNDPW,AUTHINIT) FACILITY(NETVIEW=NOPROMPT,NOAUDIT,RES,WARNPW,NOTSOC,LCFTRANS,IJU) FACILITY(NETVIEW=MSGLC,NOTRACE,NOEODINIT,NODORMPW,NONPWR) FACILITY(NETVIEW=LOG(INIT,SMF,MSG,SEC9)) FACILITY(NETVIEW=DOWN=GLOBAL,LOCKTIME=00,DEFACID(*NONE*))

V-225586 in V7R2