Title

JESNEWS resources are not protected in accordance with security requirements. (Cat II impact)

Discussion

JES2 spool resources include all SYSOUT, SYSLOG, JESTRACE, and JESNEWS data sets. Failure to properly control JES2 spool resources could result in unauthorized personnel accessing job output, system activity logs, and trace data containing userid and password information. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.

Check Content

JESSPOOL Resource Controls a) Refer to the following reports produced by the ACF2 Data Collection and Data Set and Resource Data Collection: - SENSITVE.RPT(OPERCMDS) - ACF2CMDS.RPT(RESOURCE) – Alternate report NOTE: Review the ACFGSO report. If CLASMAP defines OPERCMDS as anything other than TYPE(OPR), replace OPR below with the appropriate three letters. Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(SUBSYS) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(ZJES0042) b) Review the resource rules for the OPERCMDS resource class (i.e., TYPE(OPR)) and ensure the following items are in effect: 1) The JES2.UPDATE.JESNEWS resource is defined to the OPERCMDS resource class with a default access of PREVENT. NOTE: JES2 is typically the name of the JES2 subsystem. Refer to the SUBSYS report and locate the entry with the description of PRIMARY JOB ENTRY SUBSYSTEM. The SUBSYSTEM NAME of this entry is the name of the JES2 subsystem. 2) Access authorization to the JES2.UPDATE.JESNEWS resource in the OPERCMDS class restricts DELETE service to the appropriate personnel (i.e., users responsible for maintaining the JES News data set) and all access is logged. c) If both of the items in (b) are true, there is NO FINDING. d) If either item in (b) is untrue, this is a FINDING.

Fix Text

The IAO will ensure that access authorization for the JESNEWS resource in the OPERCMDS resource class is restricted to the appropriate personnel and , and all access is logged. Note: If CLASMAP defines OPERCMDS as anything other than TYPE(OPR), replace OPR below with the appropriate three letters. Review the resource rules for the OPERCMDS resource class (i.e., TYPE(OPR)) and ensure the following items are in effect: 1) The JES2.UPDATE.JESNEWS resource is defined to the OPERCMDS resource class with a default access of PREVENT. 2) Access authorization to the JES2.UPDATE.JESNEWS resource in the OPERCMDS class restricts DELETE service to the appropriate personnel (i.e., users responsible for maintaining the JES News data set) and all access is logged. Example: $KEY(JES2) TYPE(OPR) UPDATE.JESNEWS UID(SYSPROG) SERVICE(READ,UPDATE) LOG UPDATE.JESNEWS UID(*) PREVENT

Additional Identifiers

Rule ID: SV-7225r2_rule

Vulnerability ID: V-6924

Group Title: ZJES0042

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.