Check: TSS0275
zOS TSS STIG:
TSS0275
(in versions v6 r43 through v6 r30)
Title
The CANCEL Control Option value specified is set to CANCEL. (Cat II impact)
Discussion
The CANCEL Control Option allows security administrators to use the O/S CANCEL command to bring the TSS address space down. The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.
Check Content
Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(STATUS) Automated Analysis Refer to the following report produced by the TSS Data Collection: - PDI(TSS0275) If the CANCEL Control Option is not specified, this is not a finding.
Fix Text
Remove the CANCEL sub-option from the Control Options list. TSS MODIFY(control_option [(suboption_list)])
Additional Identifiers
Rule ID: SV-68r3_rule
Vulnerability ID: V-68
Group Title: TSS0275
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000336 |
After system changes, verify that the impacted controls are operating as intended, meeting the security requirements for the system. |
| CCI-000366 |
Implement the security configuration settings. |
| CCI-002357 |
Implement a reference monitor for organization-defined access control policies that is tamperproof. |