Title

There are LOGONIDs assigned for started tasks that do not have the STC attribute specified in the associated LOGONID record. (Cat II impact)

Discussion

If a LOGONID for a started task does not have the STC attribute specified, this could result in system or application unavailability.

Check Content

a) Refer to the following report produced by the ACF2 Data Collection: - ACF2CMDS.RPT(ATTSTC) b) Identify all logonids assigned to started tasks. c) Review every logonid record assigned to started tasks to ensure each one has the STC attribute specified. d) If all logonids identified as started tasks have the STC attribute specified, there is NO FINDING. e) If any logonid identified as a started task does not have the STC attribute specified, this is a FINDING.

Fix Text

The IAO will ensure that all logonid records assigned to started tasks have the STC attribute specified. All started tasks will be assigned an individual logonid. The logonid for a Started Task Control (STC) will be granted the minimum privileges necessary for the STC to function. In addition to the default LID field settings, all STC logonids will have the following field setting: STC Example: SET LID INSERT logonid STC

Additional Identifiers

Rule ID: SV-161r2_rule

Vulnerability ID: V-161

Group Title: ACF0600

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.