What changed in z/OS ROSCOE for ACF2 STIG V7R2V7R2 changes

Title

ROSCOE Install data sets are not properly protected.

Check text

Refer to the following report produced by the Datadataset Set and Resource Data Collection: - SENSITVE.RPT(ROSRPT). Automated Analysis Refer to the following report produced by the Datadataset Set and Resource Data Collection: - PDI(ZROS0000). Verify that access to the ROSCOE Install datadatasets setsis are properly restricted. If the following guidance is true, this is not a finding. The ACF2 datadataset set rules for the datadatasets sets does not restrict UPDATEWRITE and/or ALTERgreater access to systems programming personnel. The ACF2 datadataset set rules for the datadatasets setsdo does not specify that all (i.e., failures and successes) UPDATEWRITE and/or ALTERgreater access will be logged. If all of the above are untrue, this is not a finding. If any of the above is true, this is a finding.

Fix text

The ISSO will ensure that updateWRITE and/or allocategreater access to program product datadatasets sets is limited to systemsystems programmers only, and all updateWRITE and/or allocategreater access is logged. Security personnel and auditors should have readREAD access. The installing systems programmer will identify and document the product datadatasets, sets and categorize them according to who will have updateWRITE and/or altergreater access, and if required, ensure that all updateWRITE and/or allocategreater access is logged. The installing systems programmer will identify if any additional groups have updateUPDATE access for specific data setsdatasets, and once documented, will work with the ISSO to ensure they are properly restricted to the Access Control Program (ACP) active on the system. DataDatasets sets to be protected will be: SYS2.ROSCOE SYS2A.ROSCOE SYS3.ROSCOE SYS3A.ROSCOE The following commands are provided as a sample for implementing dataset controls: $KEY(SYS2) ROSCOE.- UID(syspaudt) R(A) W(L) A(L) E(A) ROSCOE.- UID(secaaudt) R(A) E(A) ROSCOE.- UID(audtaudt) R(A) E(A) $KEY(SYS2A) ROSCOE.- UID(syspaudt) R(A) W(L) A(L) E(A) ROSCOE.- UID(secaaudt) R(A) E(A) ROSCOE.- UID(audtaudt) R(A) E(A) $KEY(SYS3) ROSCOE.- UID(syspaudt) R(A) W(L) A(L) E(A) ROSCOE.- UID(secaaudt) R(A) E(A) ROSCOE.- UID(audtaudt) R(A) E(A) $KEY(SYS3A) ROSCOE.- UID(syspaudt) R(A) W(L) A(L) E(A) ROSCOE.- UID(secaaudt) R(A) E(A) ROSCOE.- UID(audtaudt) R(A) E(A)

Discussion

ROSCOE Install datadatasets sets provide the capability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to their datadatasets sets could result in violating the integrity of the base product, which could result in compromising the operating system or sensitive data.

V-224336 in V7R2

Title

ROSCOE STC data sets are not properly protected.

Check text

a) Refer to the following report produced by the Datadataset Set and Resource Data Collection: - SENSITVE.RPT(ROSSTC). Automated Analysis Refer to the following report produced by the Datadataset Set and Resource Data Collection: - PDI(ZROS0001). b) Verify that access to the ROSCOE STC datadatasets setsis are properly restricted. The datadatasets sets in this group are the datadatasets sets identified in the ROSACTxx (if used), ROSLIBxx, and SYSAWSx DD statements of the STC or batch JCL. If the following guidance is true, this is not a finding. ___ The ACF2 datadataset set rules for the datadatasets sets does not restrict UPDATEWRITE and/or ALTERgreater access to systems programming personnel. ___ The ACF2 datadataset set rules for the datadatasets sets does not restrict UPDATEWRITE and/or ALTERgreater access to the product STC(s) and/or batch job(s). c) If all of the above are untrue, there is NO FINDING. d) If any of the above is true, this is a FINDING.

Fix text

The IAOISSO will ensure that updateWRITE and/or allocategreater access to the ROSCOE started task or batch job datadatasets sets is limited to systemsystems programmers and the started task only, and all updateWRITE and/or allocategreater access is logged. The IAOISSO will ensure that all other accesses to the ROSCOE started task or batch job datadatasets sets are properly restricted and all required accesses are properly logged. DataDatasets sets to be protected will be: SYS3.ROSCOE.SYS** SYS3.ROSCOE.ROSLIB** Example: SET RULE $KEY(SYS3) ROSCOE.SYS- UID(syspudt) R(A) W(L) A(L) E(A) ROSCOE.SYS- UID(stc roscoe) R(A) W(L) A(L) E(A) ROSCOE.ROSLIB- UID(syspudt) R(A) W(L) A(L) E(A) ROSCOE.ROSLIB- UID(stc roscoe) R(A) W(L) A(L) E(A)

Discussion

ROSCOE STC datadatasets sets provide the capability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to their datadatasets sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.

V-224337 in V7R2

Check text

Refer to the following report produced by the ACF2 Data Collection and Datadataset Set and Resource Data Collection: - SENSITVE.RPT(ZROS0020). - ACF2CMDS.RPT(RESOURCE) - Alternate report. Automated Analysis Refer to the following report produced by the Datadataset Set and Resource Data Collection: - PDI(ZROS0020). EnsureVerify all ROSCOE resources and/or generic equivalent are properly protected according to the requirements specified in the CA ROSCOE Resources table in the z/OS STIG Addendum. Note: Wherever an access or user group is missing, use the Site Security Plan to determine access and/or user group. If the following guidance is true, this is not a finding. The ACF2 resources are defined with a default access of PREVENT. The ACF2 resource access authorizations restrict access to the appropriate personnel. The ACF2 resource logging is correctly specified.

Fix text

The ISSO will work with the systems programmer to verify that the following are properly specified in the Access Control Program (ACP). (Note: The resource type, resources, and/or resource prefixes identified below are examples of a possible installation. The actual resource type, resources, and/or resource prefixes are determined when the product is actually installed on a system through the product's installation guide and can be site specific.) Ensure that all ROSCOE resources and/or generic equivalent are properly protected according to the requirements specified in CA ROSCOE Resources table in the z/OS STIG Addendum. Use CA ROSCOE Resources table in the z/OS STIG Addendum. This table lists the resources, access requirements, and logging requirements for ROSCOE ensure the following guidelines are followed: The ACF2 resources are defined with a default access of PREVENT. The ACF2 resource access authorizations restrict access to the appropriate personnel. The ACF2 resource logging is correctly specified. The following commands are provided as a sample for implementing resource controls: $KEY(rosid) TYPE(ROS) ROSCMD.ETSO UID(*) SEVICE(READ) ROSCMD.MONITOR.- UID(syspaudt) ALLOW ROSCMD.MONITOR.AMS UID(syspaudt) ALLOW ROSCMD.MONITOR.AMS UID(*) SEVICE(READ) ROSCMD.- UID(syspaudt) ALLOW - UID(*) PREVENT

Discussion

ROSCOE can run with sensitive system privileges, and potentially can circumvent system controls. Failure to properly control access to product resources could result in the compromise of the operating system environment, and compromise the confidentiality and integrity of customer data. Many utilities assign resource controls that can be granted to systemsystems programmers only in greater than read authority. Resources are also granted to certain nonsystems personnel with read only authority.

V-224338 in V7R2

Title

ROSCOE Started Task name is not properly identified / defined to the system ACP.

Check text

a) Refer to the following report produced by the ACF2 Data Collection: - ACF2CMDS.RPT(LOGONIDS). b) EnsureIf the followinglogonids fieldsspecified arebelow completedhave forall eachthe STCrequired logonidfields forcompleted theand product: STC JOBFROM MUSASS NO-SMC c) Ensureif the following fieldsattributes are completeddefined, forthis eachis Batchnot logonida forfinding. For theStarted productTasks logonid: JOBSTC JOBFROM MUSASS NO-SMC d) IfFor theBatch logonids specified in (b) and/or (c) have all the required fields are completed, this is not a FINDING.logonid: e) If the logonids specified in (b) and/or (c) do not have all the above fields completed, this is a FINDING.JOB JOBFROM MUSASS NO-SMC

Fix text

The ROSCOE systemsystems programmer and the IAOISSO will ensureverify that a product's Started Task(s) is properly Identified identified/ defined to the System ACP. If the product requires a Started Task, verify that it is properly defined to the System ACP with the proper attributes. Most installation manuals will indicate how the Started Task is identified and any additional attributes that must be specified. Example: SET LID CHANGE ROSCOE STC JOBFROM MUSASS NO-SMC

Discussion

Products that require a started task will require that the started task be restricted to certain resources, datasets, and other system functions. ByDefining defining the started task as a userid to the system ACP, It allows the ACP to control the access and authorized users that require these capabilities. Failure to properly control these capabilities, could compromise of the operating system environment, ACP, and customer data.

V-224339 in V7R2

Check text

EnsureRefer thatto the following GSOreport CLASMAPproduced recordby entriesthe areACF2 definedData Collection: CLASMAPqual- RESOURCEACF2CMDS.RPT(ROSRESACFGSO) RSRCTYPE(rosid) ENTITYLN(nn). If allthe offollowing theGSO itemsCLASMAP inrecord entry(bies) is (are) truedefined, this is not a finding. IfCLASMAPqual anyRESOURCE(ROSRES) item in RSRCTYPE(brosid) is untrue, this is a finding.ENTITYLN(nn) Note: The site determines the appropriate three letter RSRCTYPE that is unique for each Roscoe system. The ENTITYLN should be appropriate for the site's installation.

V-224340 in V7R2

Check text

Have the product's systemsystems programmer display the configuration/parameters control statements used in the current running product to define or enable security. This information is located in the SYSIN DD statement in the JCL of the STC/Batch job. Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(ZROS0040). Verify the following specifications:. This is not a finding. Keyword Value EXTSEC ACF2 ACFEXT YES CLLEXT YES JOBEXT YES LIBEXT YES MONEXT YES PRVEXT YES RPFEXT YES UPSEXT YES If the above is true, this is not a finding. If the above is untrue, this is a finding.

V-224341 in V7R2