What changed in z/OS SRRAUDIT for RACF STIG V7R2V7R2 changes

Check text

Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(SRRPROD). Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZSRR0000). Verify that the accesses to the SRRAUDIT installation data sets are properly restricted. If the following guidance is true, this is not a finding. The RACF data set access authorizations restrict READ access to systems programming personnel, domain level production control and scheduling personnel, security personnel, and auditors. The RACF data set access authorizations restrict WRITE and/or greater access to systems programming personnel. The RACF data set access authorizations specify that all (i.e., failures and successes) WRITE and/or greater accesses are logged. The RACF data set access authorizations specify UACC(NONE) and NOWARNING.

V-224535 in V7R2

Check text

a) Refer to the following report produced by the Data Set and Resource Data Collection: - SENSITVE.RPT(SRRUSER). Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZSRR0002). b) Verify that access to the SRRAUDIT User data sets are properly restricted. If the following guidance is true, this is not a finding. ___ The RACF data set rules for the data sets does not restrict READ, UPDATE, and/or ALTERgreater access to systems programming personnel, security personnel, and auditors. ___ The RACF data set rules for the data sets do not specify that all (i.e., failures and successes) UPDATEWRITE and/or ALTERgreater access will be logged. b) If all of the above are untrue, there is NO FINDING. c) If any of the above is true, this is a FINDING.

Fix text

The IAOISSO will ensure that readREAD, updateUPDATE, and alterALTER access to program product user data sets is limited to System Programmers, Security Personnel, and Auditors and all updateWRITE and/or altergreater access is logged. The installing System Programmer will identify and document the product user data sets and categorize them according to who will have updateWRITE and/or altergreater access and if required that all updateWRITE and/or altergreater access is logged. He will identify if any additional groups have updateUPDATE access for specific data sets, and once documented he will work with the IAOISSO to see that they are properly restricted to the ACP (Access Control Program ) active on the system. Data set prefix to be protected will be: SYS3.SRRAUDIT. The following commands are provided as a sample for implementing datasetdata set controls: ad 'sys3.srraudit.**' uacc(none) owner(sys3) - audit(success(update) failures(read)) - data('Vendor DS Profile: SRRAUDIT - security automation project, sso-developed self-audit toolkit') pe 'sys3.srraudit.**' id(syspaudt secaaudt audtaudt) acc(a) If doing a full SRR review using the z/OS STIG Instruction, the following data set prefix to be protected will be: SYS3.FSO. The following commands are provided as a sample for implementing datasetdata set controls: ad 'sys3.fso.**' uacc(none) owner(sys3) - audit(success(update) failures(read)) - data('Used for full SRR Review') pe 'sys3.fso.**' id(syspaudt secaaudt audtaudt) acc(a)

V-224536 in V7R2