Check: AAMV0014
zOS ACF2 STIG:
AAMV0014
(in versions v6 r43 through v6 r30)
Title
Site must have a formal migration plan for removing or upgrading OS systems software prior to the date the vendor drops security patch support. (Cat II impact)
Discussion
Vendors' code may contain vulnerabilities that may be exploited to cause denial of service or to violate the integrity of the system or data on the System. Most vendors develop patches to correct these vulnerabilities. When vendors' products become unsupported, the creation of these patches cease leaving the system exposed to any future vulnerabilities not patched. Without a documented migration plan established to monitor system software versions and releases unsupported software may be allowed to run on the system.
Check Content
Refer to Vulnerability Questions within the SRRAUDIT Dialog Management document. Check with the Systems programmer to make sure that a documented migration plan exists to monitor system software products versions and releases for end-of-life/nonsupport dates. Verify that the procedure notifies management to start procedures to upgrade to supported versions of the products or removal before that date. Automated Analysis Refer to the following report produced by the z/OS Data Collection: - PDI(AAMV0014) If documented procedures exist to monitor system software products for dates they will become unsupported and to notify management to upgrade to supported versions of the products, this is not a finding. Note: If product support is provided through an outside group or the site, verify that they have a process to notify the site of unsupported software.
Fix Text
The ISSO/ISSM will verify that a process is documented and followed for unsupported software.
Additional Identifiers
Rule ID: SV-8019r3_rule
Vulnerability ID: V-7546
Group Title: AAMV0014
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000409 |
The organization updates the inventory of information system components as an integral part of component removals. |
CCI-001225 |
The organization identifies information system flaws. |
CCI-001227 |
The organization corrects information system flaws. |
CCI-002606 |
The organization defines the time period following the release of updates within which security-related firmware updates are to be installed. |
CCI-002615 |
The organization defines the software components to be removed (e.g., previous versions) after updated versions have been installed. |
CCI-002617 |
The organization removes organization-defined software components (e.g., previous versions) after updated versions have been installed. |