Check: ZCICA025
zOS ACF2 STIG:
ZCICA025
(in versions v6 r43 through v6 r30)
Title
Sensitive CICS transactions are not protected in accordance with the proper security requirements. (Cat II impact)
Discussion
Sensitive CICS transactions offer the ability to circumvent transaction level controls for accessing resources under CICS. These transactions must be protected so that only authorized users can access them. Unauthorized use can result in the compromise of the confidentiality, integrity, and availability of the operating system or customer data.
Check Content
a) Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(CICSPROC) Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. b) Browse the ACF2/CICS data set allocated by the ACF2PARM DD statement in the JCL of each CICS procedure. c) If the PROTLIST parameter is not specified for all CICS regions, there is NO FINDING. d) If the PROTLIST parameter is specified for any CICS region, this is a FINDING.
Fix Text
The Systems Programmer and IAO will ensure the ACF2/CICS parameter PROTLIST is not coded. Browse the ACF2/CICS data set allocated by the ACF2PARM DD statement in the JCL of each CICS procedure. Make sure the PROTLIST parameter is not specified for all CICS regions.
Additional Identifiers
Rule ID: SV-7191r2_rule
Vulnerability ID: V-6896
Group Title: ZCICA025
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-002235 |
The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures. |
Controls
| Number | Title |
|---|---|
| AC-6 (10) |
Prohibit Non-Privileged Users From Executing Privileged Functions |