Check: TSS0-ES-000070
IBM z/OS TSS STIG:
TSS0-ES-000070
(in versions v8 r13 through v7 r1)
Title
The CA-TSS NPPTHRESH Control Option must be properly set. (Cat II impact)
Discussion
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-force attacks, is reduced. Limits are imposed by locking the account.
Check Content
From the ISPF Command Shell enter: TSS MODIFY STATUS If the PTHRESH Control Option value is not set to NPPTHRESH(02), this is a finding.
Fix Text
Evaluate the impact associated with implementation of the control option. Develop a plan of action to implement the control option setting as specified following and proceed with the change. NPPTHRESH(02)
Additional Identifiers
Rule ID: SV-223880r877721_rule
Vulnerability ID: V-223880
Group Title: SRG-OS-000021-GPOS-00005
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000044 |
The information system enforces the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period. |
Controls
| Number | Title |
|---|---|
| AC-7 |
Unsuccessful Logon Attempts |