Title

Password changes to the MSCA ACID will be documented in the change log. (Cat II impact)

Discussion

The system MSCA will be a limited use ACID, which is not available to any individual for day to day processing. Limit its use only to performing required security administration functions. The Primary SCA will assume the use of, and the responsibility for, the MSCA by changing the MSCA password. The password change command will include a comment indicating the reason.

Check Content

Refer to the following report produced by the TSS Data Collection: - TSSCHNGS.RPT Note: If running Quest NC-Pass, validate in ZNCP0020 that the MSCA ACID has the FACILITY of NCPASS and SECURID resource in the ABSTRACT resource class. If the MSCA password changes are documented in the change log, this is not a finding.

Fix Text

The IAO will ensure that the MSCA password changes are documented with comments in the the TSS Recovery file. The TSS Recovery file will be of sufficient size to ensure that the change is documented.

Additional Identifiers

Rule ID: SV-236r2_rule

Vulnerability ID: V-236

Group Title: TSS0880

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.