Check: TSS0-IC-000050
IBM z/OS TSS STIG:
TSS0-IC-000050
(in versions v9 r2 through v8 r6)
Title
IBM Integrated Crypto Service Facility (ICSF) Started task(s) must be properly defined to the Started Task Table ACID for Top Secret. (Cat II impact)
Discussion
Access to product resources should be restricted to only those individuals responsible for the application connectivity and who have a requirement to access these resources. Improper control of product resources could potentially compromise the operating system, ACP, and customer data.
Check Content
from the ISPF Command Shell enter TSS LIST(STC) If the IBM Integrated Crypto Service Facility (ICSF) started task(s) is (are) not defined in the TSS STC record this is a finding.
Fix Text
The IBM Integrated Crypto Service Facility (ICSF) system programmer and the IAO will ensure that a product's started task(s) is (are) properly identified and/or defined to the System ACP. A unique ACID must be assigned for the IBM Integrated Crypto Service Facility (ICSF) started task(s) thru a corresponding STC table entry. The following sample set of commands is shown here as a guideline: TSS ADD(STC) PROCNAME(CSFSTART) ACID(CSFSTART)
Additional Identifiers
Rule ID: SV-255943r958482_rule
Vulnerability ID: V-255943
Group Title: SRG-OS-000104-GPOS-00051
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000764 |
Uniquely identify and authenticate organizational users and associate that unique identification with processes acting on behalf of those users. |
Controls
| Number | Title |
|---|---|
| IA-2 |
Identification and Authentication (organizational Users) |