Check: HLP0020
IBM Hardware Management Console (HMC) STIG:
HLP0020
(in versions v2 r1 through v1 r5)
Title
On Classified Systems, Logical Partition must be restricted with read/write access to only its own IOCDS. (Cat II impact)
Discussion
Unrestricted control over the IOCDS files could result in unauthorized updates and impact the configuration of the environment by allowing unauthorized access to a restricted resource. This could severely damage the integrity of the environment and the system resources.
Check Content
Using the Hardware Management Console, verify that a logical partition cannot read or write to any IOCDS. Use the Security Definitions Page panel to do this by checking to see if the Input/Output (I/O) Configuration Control option has been turned on. NOTE: The default is applicable to only classified systems. Confirm whether or not the I/O Configuration Control option is checked. If the Logical Partition is not restricted with read/write access to only its own IOCDS, this is a FINDING.
Fix Text
Review the Security Definition parameters specified under Processor Resource/Systems Manager (PR/SM). Verify and implement the correct settings.
Additional Identifiers
Rule ID: SV-256863r958472_rule
Vulnerability ID: V-256863
Group Title: SRG-OS-000080-GPOS-00048
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000213 |
Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies. |
Controls
| Number | Title |
|---|---|
| AC-3 |
Access Enforcement |