Check: ACF0820
zOS ACF2 STIG:
ACF0820
(in versions v6 r43 through v6 r30)
Title
The number of users granted the special privilege CONSOLE is not justified. (Cat II impact)
Discussion
Users with this privilege could intentionally or inadvertently issue console commands that could cause system resources and customer data to become unavailable.
Check Content
a) Refer to the following report produced by the ACF2 Data Collection: - ACF2CMDS.RPT(ATTCONSL) Automated Analysis Refer to the following report produced by the ACF2 Data Collection Checklist: - PDI(ACF0820) b) If the number of users granted the special privilege CONSOLE is strictly controlled (issued on an as-needed basis), there is NO FINDING. c) If the number of users granted the special privilege CONSOLE is not strictly controlled (issued on an as-needed basis), this is a FINDING.
Fix Text
The IAO will ensure that access to the CONSOLE attribute is kept to a minimum and is controlled and documented. Review all LOGONIDs with the CONSOLE attribute. Ensure documentation providing justification for access is maintained and filed with the IAO and that unjustified access is removed.
Additional Identifiers
Rule ID: SV-178r2_rule
Vulnerability ID: V-178
Group Title: ACF0820
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000213 |
The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies. |
| CCI-000226 |
The information system provides the capability for a privileged administrator to configure organization-defined security policy filters to support different security policies. |
Controls
| Number | Title |
|---|---|
| AC-3 |
Access Enforcement |