Check: TSS0-OS-000320
IBM z/OS TSS STIG:
TSS0-OS-000320
(in versions v9 r2 through v8 r4)
Title
The IBM z/OS systems requiring data at rest protection must properly employ IBM DS8880 or equivalent hardware solutions for full disk encryption. (Cat I impact)
Discussion
This control addresses the confidentiality and integrity of information at rest and covers user information and system information. Information at rest refers to the state of information when it is located on storage devices as specific components of information systems. Operating systems handling data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. Selection of a cryptographic mechanism is based on the need to protect the integrity of organizational information. The strength of the mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields). Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The operating system must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. Satisfies: SRG-OS-000185-GPOS-00079, SRG-OS-000405-GPOS-00184, SRG-OS-000404-GPOS-00183, SRG-OS-000396-GPOS-00176
Check Content
Determine if IBM's DS880 Disks or equivalent hardware solutions are in use. If IBMs DS880 Disks or equivalent hardware solutions are not in use for systems that require "data at rest", this is a finding.
Fix Text
Employ IBM's DS8880 hardware or equivalent hardware solutions to ensure full disk encryption.
Additional Identifiers
Rule ID: SV-251108r1028298_rule
Vulnerability ID: V-251108
Group Title: SRG-OS-000404-GPOS-00183
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-001199 |
Protects the confidentiality and/or integrity of organization-defined information at rest. |
| CCI-002420 |
Maintain the confidentiality and/or integrity of information during preparation for transmission. |
| CCI-002445 |
Distribute symmetric cryptographic keys using NIST FIPS-validated or NSA-approved key management technology and processes. |
| CCI-002446 |
Produce asymmetric cryptographic keys using: NSA-approved key management technology and processes; prepositioned keying material; DoD-approved or DoD-issued Medium Assurance PKI certificates; DoD-approved or DoD-issued Medium Hardware Assurance PKI certificates and hardware security tokens that protect the user's private key; or certificates issued in accordance with organization-defined requirements. |
| CCI-002475 |
Implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest on organization-defined system components. |
| CCI-002476 |
Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined information at rest on organization-defined system components. |