STIGQter STIGQter: STIG Summary: IBM z/OS RACF Security Technical Implementation Guide Version: 8 Release: 3 Benchmark Date: 23 Apr 2021:

IBM RACF USERIDs possessing the Tape Bypass Label Processing (BLP) privilege must be justified.

DISA Rule

SV-223662r604139_rule

Vulnerability Number

V-223662

Group Title

SRG-OS-000080-GPOS-00048

Rule Version

RACF-ES-000140

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Review all USERIDs with the BLP attribute. Ensure documentation providing justification for access is maintained and filed with the ISSO, and that unjustified access is removed.

BLP is controlled thru the FACILITY class profile ICHBLP. Access is removed with the following command:
PE ICHBLP CL(FACILITY) id(<userid>) DELETE
a subsequent REFRESH of the FACILITY class may be required via the command: SETR RACL(FACILITY) REFRESH

Check Contents

From the ISPF Command Shell enter:
RLIST FACILITY ICHBLP AUTHUSER

If access authorization to the ICHBLP resource is restricted at the userid level to data center personnel (e.g., tape librarian, operations staff, etc.), this is not a finding.

If no tape management system (e.g., CA-1) is installed the following:
From the ISPF Command Shell enter:
SETROPTS LIST

If the TAPEVOL class is active, this is not a finding.

Vulnerability Number

V-223662

Documentable

False

Rule Version

RACF-ES-000140

Severity Override Guidance

From the ISPF Command Shell enter:
RLIST FACILITY ICHBLP AUTHUSER

If access authorization to the ICHBLP resource is restricted at the userid level to data center personnel (e.g., tape librarian, operations staff, etc.), this is not a finding.

If no tape management system (e.g., CA-1) is installed the following:
From the ISPF Command Shell enter:
SETROPTS LIST

If the TAPEVOL class is active, this is not a finding.

Check Content Reference

M

Target Key

4101

Comments