Check: IFTP0100
zOS RACF STIG:
IFTP0100
(in versions v6 r43 through v6 r30)
Title
FTP / Telnet unencryted transmissions require Acknowledgement of Risk Letter(AORL) (Cat II impact)
Discussion
In addition to the data transmission being in the clear, the user credentials are also passed in the clear, which violates the control IAIA-1. As mitigation for this vulnerability, special consideration must be given to account maintenance and the types of user privileges associated with these accounts. Interception of the above information could result in the compromise of the operating system environment, ACP, and customer data.
Check Content
a) Provide a list of all FTP userids defined to the ACP database, including the function and purpose of each FTP userid. b) Refer to the to the above list c) Ensure that an Acknowledgement of Risk Letter exist for all userids utilizing unencrypted communications. d) If (c) is true, there is NO FINDING. e) If (c) is untrue, this is a FINDING.
Fix Text
Ensure that an Acknowledgement of Risk Letter exist for all userids utilizing unencrypted communications.
Additional Identifiers
Rule ID: SV-8757r2_rule
Vulnerability ID: V-8271
Group Title: IFTP0100
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000041 |
The organization authorizes network access to organization-defined privileged commands only for organization-defined compelling operational needs. |
| CCI-000042 |
The organization documents the rationale for authorized network access to organization-defined privileged commands in the security plan for the information system. |
| CCI-001037 |
The organization develops and documents a risk assessment policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance. |
| CCI-001499 |
The organization limits privileges to change software resident within software libraries. |