Title

On Classified Systems, Logical Partition must be restricted with read/write access to only its own IOCDS. (Cat II impact)

Discussion

Unrestricted control over the IOCDS files could result in unauthorized updates and impact the configuration of the environment by allowing unauthorized access to a restricted resource. This could severely damage the integrity of the environment and the system resources.

Check Content

Using the Hardware Management Console, verify that a logical partition cannot read or write to any IOCDS. Use the Security Definitions Page panel to do this by checking to see if the Input/Output (I/O) Configuration Control option has been turned on. NOTE: The default is applicable to only classified systems. Confirm whether or not the I/O Configuration Control option is checked. If the Logical Partition is not restricted with read/write access to only its own IOCDS, this is a FINDING.

Fix Text

Review the Security Definition parameters specified under Processor Resource/Systems Manager (PR/SM). Verify and implement the correct settings.

Additional Identifiers

Rule ID: SV-30053r2_rule

Vulnerability ID: V-24379

Group Title: HLP0020

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.