What changed in z/OS TADz for ACF2 STIG V7R2V7R2 changes

Title

Tivoli Asset Discovery for z/OS (TADz) Install data sets are not properly protected.

Check text

Refer to the following report produced by the Datadataset Set and Resource Data Collection: - SENSITVE.RPT(TADZRPT). Automated Analysis Refer to the following report produced by the Datadataset Set and Resource Data Collection: - PDI(ZTAD0000). Verify that access to the TADz Install datadatasets setsis are properly restricted. If the following guidance is true, this is not a finding. The ACF2 datadataset set rules for the datadatasets sets does not restrict UPDATEWRITE and/or ALTERgreater access to systems programming personnel. The ACF2 datadataset set rules for the datadatasets setsdo does not specify that all (i.e., failures and successes) UPDATEWRITE and/or ALTERgreater access will be logged. If all of the above are untrue, this is not a finding. If any of the above is true, this is a finding.

Fix text

The ISSO will ensure that updateWRITE and/or allocategreater access to program product datadatasets sets is limited to systemsystems programmers only, and all updateWRITE and/or allocategreater access is logged. Auditors should have readREAD access. The installing systems programmer will identify and document the product datadatasets, sets and categorize them according to who will have updateWRITE and/or altergreater access, and if required, ensure that all updateWRITE and/or allocategreater access is logged. The installing systems programmer will identify if any additional groups have updateUPDATE access for specific data setsdatasets, and once documented, will work with the ISSO to ensure they are properly restricted to the Access Control Program (ACP) active on the system. DataDatasets sets to be protected will be: SYS2.TADZ SYS2.TADZ .V-.SHSIMOD1 SYS3.TADZ The following commands are provided as a sample for implementing dataset controls: $KEY(SYS2) TADZ.- UID(syspaudt) R(A) W(L) A(L) E(A) TADZ.V-.SHSIMOD1 UID(syspaudt) R(A) W(L) A(L) E(A) TADZ.- UID(audtaudt) R(A) E(A) $KEY(SYS3) TADZ.- UID(syspaudt) R(A) W(L) A(L) E(A) TADZ.- UID(audtaudt) R(A) E(A)

Discussion

Tivoli Asset Discovery for z/OS (TADz) Install datadatasets sets provide the capability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to their datadatasets sets could result in violating the integrity of the base product, which could result in compromising the operating system or sensitive data.

V-224344 in V7R2

Title

Tivoli Asset Discovery for zOS (TADz) STC and/or batch data sets are not properly protected.

Check text

Refer to the following report produced by the Datadataset Set and Resource Data Collection: - SENSITVE.RPT(TADZSTC). Automated Analysis Refer to the following report produced by the Datadataset Set and Resource Data Collection: - PDI(ZTAD0001). ForVerify allthat (access to the TADz) STC and/or batch datadatasets sets:are properly restricted. If the following guidance is true, this is not a finding. IfThe ACF2 dataset rules for the UPDATEdatasets restrict WRITE and/or greater access is restricted to systems programming personnel and the product STC(s) and/or batch job(s) this is not a finding. IfThe anyACF2 jobdataset schedulingrules productsfor arethe indatasets userestrict andREAD access is restricted to READjob thisscheduling is not a findingproducts. IfThe auditorsACF2 havedataset READrules accessfor thisthe isdatasets notrestrict aREAD findingaccess to auditors.

Fix text

Grant updateWRITE and/or altergreater access to Tivoli Asset Discovery for z/OS (TADz) STC and/or batch datadatasets sets are limited to systemsystems programmers and TADz STC and/or batch jobs only. Grant readREAD access to any scheduling products that are in use. Grant readREAD access to auditors at the ISSO's discretion. Identify and document the product datadatasets sets and categorize them according to who will have updateWRITE and/or altergreater access and, if required, that all updateWRITE and/or allocategreater access is logged. Identify if any additional groups have updateUPDATE access for specific data setsdatasets, and assure that they are properly restricted to the ACP (Access Control Program) active on the system. DataDatasets sets to be protected will be: SYS3.TADZ The following commands are provided as a sample for implementing dataset controls: $KEY(SYS3) TADZ.- UID(syspaudt) R(A) W(A) A(A) E(A) TADZ.- UID(audtaudt) R(A) E(A) TADZ.-.UM.- UID(batchid TADZINQ) R(A) W(A) A(A) E(A) TADZ.-.IQ.- UID(batchid TADZINQ) R(A) W(A) A(A) E(A) TADZ.-.UIQ.- UID(batchid TADZINQ) R(A) W(A) A(A) E(A) TADZ.- UID(stc id TADZMON) R(A) W(A) A(A) E(A)

Discussion

Tivoli Asset Discovery for zOS (TADz) STC datadatasets sets provide the capability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to their datadatasets sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.

V-224345 in V7R2

Check text

Refer to the following report produced by the ACF2 Data Collection: - ACF2CMDS.RPT(LOGONIDS). EnsureVerify thethat following field is completed for each STC logonid for the product: STC Ensure the following field is completed for each Batch logonid(s) for the product: JOB IfTADz thestarted logonids specified in task(bs) and/oris (care) haveproperly alldefined. If the requiredfollowing fieldattributes isare completeddefined, this is not a FINDINGfinding. IfFor theeach logonidsSTC specifiedlogonid: STC For ineach (b)Batch and/or (c) do not have the above field completed, this is a FINDING.logonid: JOB

Fix text

The TADz systemsystems programmer and the ISSO will ensure that a product's Started Task(s) is properly identified / defined to the System ACP. If the product requires a Started Task, verify that it is properly defined to the System ACP with the proper attributes. Most installation manuals will indicate how the Started Task is identified and any additional attributes that must be specified. Example: SET LID CHANGE TADZMON STC

V-224346 in V7R2