Check: ZCICT041
z/OS IBM CICS Transaction Server for TSS STIG:
ZCICT041
(in versions v6 r9 through v6 r5)
Title
CICS userids are not defined and/or controlled in accordance with proper security requirements. (Cat II impact)
Discussion
CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.
Check Content
a) Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(WHOOPROP) Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010. b) Ensure the CICS region is defined to the PROPCNTL resource class. c) If (b) are true, there is NO FINDING. d) If (b) is untrue, this is a FINDING.
Fix Text
Ensure the CICS region is defined to the PROPCNTL resource class. Example: TSS ADDTO(owning acid) PROPCNTL(CICS region acid)
Additional Identifiers
Rule ID: SV-224736r520312_rule
Vulnerability ID: V-224736
Group Title: SRG-OS-000080
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000213 |
The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies. |
Controls
Number | Title |
---|---|
AC-3 |
Access Enforcement |