Mainframe Product SRG Version Comparison

There are 4 differences between versions v1 r3 (Oct. 25, 2019) (the "left" version) and v2 r1 (Oct. 26, 2022) (the "right" version).

Check SRG-APP-000093-MFP-000138 was removed from the benchmark in the "right" version. The text below reflects the old wording.

This check's original form is available here.

Title

The Mainframe Product must provide the capability for authorized users to capture, record, and log all content related to a user session.

Check Content

If the Mainframe Product has no function or capability for session operations, this is not applicable. Examine installation and configuration settings. If the Mainframe Product does not have the capability to capture, record, and audit user sessions, this is a finding. If the Mainframe Product does not restrict the ability to capture, record, and audit user sessions to system programmers or security administrators, this is a finding. If an external security manager (ESM) is in use, examine the configuration and rules to determine if the ability to capture, record, and audit user sessions is restricted to system programmers or security administrators. If it is not, this is a finding.

Discussion

Without the capability to capture, record, and log all content related to a user session, investigations into suspicious user activity would be hampered. This requirement does not apply to Mainframe Products that do not have a concept of a user session (e.g., calculator).

Fix

Configure the Mainframe Product to permit authorized users to capture, record, and log all content related to a user session. If an ESM is in use, configure the rules to restrict the ability to capture, record, and audit user sessions to system programmers and security administrators.