Title

IBM RACF DASD volume-level protection must be properly defined. (Cat II impact)

Discussion

To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Information systems use access control policies and enforcement mechanisms to implement this requirement.

Check Content

From the ISPF Command Shell enter: RLIST DASDVOL AUTHUSER If a profile of "**" is defined for the "DASDVOL" resource class, this is not finding. If access authorization to "DASDVOL" profiles is restricted to Storage Management Personnel, Storage Management Batch Userids, and Systems Programmers, this is not a finding. If all (i.e., failures and successes) access is logged, this is not a finding.

Fix Text

Develop a plan of action to implement the required changed. Define profiles in the "DASDVOL" class. A sample command is provided here: RDEF DASDVOL ** UACC(NONE) OWNER(<StgMgmtGrp>) AUDIT(ALL(READ)). More specific "DASDVOL" profiles should be defined to protect groups of "DASDVOLs". A sample command to create a profile protecting all DASDVOLs beginning with "SYS" is provided here: RDEF DASDVOL SYS* UACC(NONE) OWNER(<StgMgmtGrp>) AUDIT(ALL(READ)). Permission can be granted to "DASDVOL" profiles. A sample command is provided here: PE SYS* CLASS(DASDVOL) ID(<syspsmpl>) ACCESS(ALTER) If any profiles are in "WARN" mode, they should be reset. A sample command is provided here: RALT DASDVOL <profilename> NOWARN. Note that the "GDASDVOL" class can also be used. See the RACF Security Admin Guide for more information.

Additional Identifiers

Rule ID: SV-223663r604139_rule

Vulnerability ID: V-223663

Group Title: SRG-OS-000080-GPOS-00048

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.