Title

PASSWORD data set and OS passwords are utilized. (Cat II impact)

Discussion

All protection of system resources must come from the ACP. If multiple protection mechanisms are in place, the accessibility of data, specifically under contingency plan execution, is subject to compromise.

Check Content

a) Refer to the following report produced by the z/OS Data Collection: - EXAM.RPT(PASSWORD) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(AAMV0440) b) If, based on the information provided, it can be determined that the system PASSWORD data set and OS passwords are not used, there is NO FINDING. c) If it is evident that OS passwords are utilized, this is a FINDING.

Fix Text

System programmers will ensure that the old OS Password Protection is not used and any data protected by the old OS Password technology is removed and protection is replaced by the ACP. Review the contents of the PASSWORD data set. Ensure that any protections it provides are provided by the ACP and delete the PASSWORD data set. Access to data sets on z/OS systems can be protected using the OS password capability of MVS. This capability has been available in MVS for many years, and its use is commonly found in data centers. Since the advent of ACPs, the use of OS passwords for file protection has diminished, and is commonly considered archaic and of little use. The use of z/OS passwords is not supported by all the ACPs.

Additional Identifiers

Rule ID: SV-107r2_rule

Vulnerability ID: V-107

Group Title: AAMV0440

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.