Title

Dataset masking characters are not properly defined to the security database. (Cat II impact)

Discussion

TSS provides masking as an additional method for reducing the number of entries that must be made to secure the installation data sets. Shared patterns can be used as the operands of data set parameters. If these characters are not defined to the database, each data set name or resource must be specifically entered into the database. This additional workload for security administrator presents the increased possibility of exposure when granting access to data sets.

Check Content

a) Refer to the following report produced by the TSS Data Collection: - TSSCMDS.RPT(WHOODSN) Automated Analysis Refer to the following report produced by the Data Set and Resource Data Collection: - PDI(TSS1000) b) Review ownership of all dataset masking characters. (*, %, and +) c) If dataset masking characters are owned by the MSCA, there is NO FINDING. d) If all dataset masking characters are defined, there is NO FINDING. e) If any of the above is untrue, this is a FINDING.

Fix Text

The IAO will ensure that the MSCA owns all dataset masking characters. Review the resource definitions for dataset masking characters ensuring they are defined to the security database. Evaluate the impact of correcting the deficiency. Develop a plan of action and implement the required changes. Example TSS commands to protect masking characters: TSS ADD(msca) DSN(*) TSS ADD(msca) DSN(%) TSS ADD(msca) DSN(+)

Additional Identifiers

Rule ID: SV-22r2_rule

Vulnerability ID: V-22

Group Title: TSS1000

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.