Check: ACF0780
zOS ACF2 STIG:
ACF0780
(in versions v6 r43 through v6 r30)
Title
The LOGONIDs with the AUDIT or CONSULT attribute must be properly scoped. (Cat II impact)
Discussion
Individuals with these attributes have the ability to view security definitions for resources not in their scope. This could result in the compromise of the confidentiality, integrity, and availability of the ACP, or customer data.
Check Content
Refer to the following reports produced by the ACF2 Data Collection: - ACF2CMDS.RPT(ATTAUDIT) - ACF2CMDS.RPT(ATTCONST) Automated Analysis Refer to the following report produced by the ACF2 Data Collection: - PDI(ACF0780) Ensure all logonids with the attributes AUDIT and/or CONSULT also have the SCPLIST attribute specified properly according to job function and areas of responsibility. NOTE: SCPLST attributes are not required for Logonids with the attributes AUDIT or CONSULT if the security IAM/IAO determines it requires ability to view the entire ACF2 environment. SCPLST attributes are not required for Auditors, Domain Level Security Admin Logonids, and BATCH Logonids that review the entire ACF2 environment to include GSO records, data set and resource rules, etc. or run audit reports.
Fix Text
The IAO will ensure that logonids with the AUDIT or CONSULT attributes are restricted by a SCPLIST attribute that restricts authority based on job function and area of responsibility. The following user attributes allow viewing of the ACF2 databases for the purpose of inspecting users, data set access rules, and Infostorage records. When granted to a logonid, restrict the scope of the following attributes using an associated SCPLIST (scope list) record: AUDIT CONSULT
Additional Identifiers
Rule ID: SV-174r2_rule
Vulnerability ID: V-174
Group Title: ACF0780
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000035 |
The information system provides the capability for privileged administrators to configure the organization-defined security policy filters to support different security policies. |
| CCI-000213 |
The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies. |
| CCI-002234 |
The information system audits the execution of privileged functions. |
| CCI-002235 |
The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. |