STIGQter: STIG Summary: IBM z/OS RACF Security Technical Implementation Guide Version: 8 Release: 3 Benchmark Date: 23 Apr 2021:

IBM RACF must limit Write or greater access to SYS1.UADS to system programmers only, and WRITE or greater access must be limited to system programmer personnel and/or security personnel.

DISA Rule

SV-223667r604139_rule

Vulnerability Number

V-223667

Group Title

SRG-OS-000080-GPOS-00048

Rule Version

RACF-ES-000190

Severity

CAT I

CCI(s)

• CCI-000213 - The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
• CCI-002235 - The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

Weight

10

Fix Recommendation

Evaluate the impact of correcting any deficiency. Develop a plan of action and implement the changes as required to protect SYS1.UADS.
SYS1.UADS WRITE or Greater authority is limited to the systems programming staff.
READ and/or UPDATE access should be limited to the security staff.
READ access is limited to Auditors when included in the site security plan.
Configure allocate access to SYS1.UADS to be limited to system programmers only, Read and Update access to SYS1.UADS to be limited to system programmer personnel and/or security personnel, and all dataset access is logged.

Check Contents

The ESM data set rules for SYS1.UADS restrict WRITE or Greater access to only z/OS systems programming personnel.

The ESM data set rules for SYS1.UADS restrict READ and/or UPDATE access to z/OS systems programming personnel and/or security personnel.

The ESM data set rules for SYS1.UADS restrict READ access to auditors as documented in Security Plan.

The ESM data set rules for SYS1.UADS specify that all (i.e., failures and successes) data set access authorities (i.e., READ, UPDATE, ALTER, and CONTROL) will be logged.

If all of the above are untrue, this is not a finding.

If any of the above is true, this is a finding.

Vulnerability Number

V-223667

Documentable

False

Rule Version

RACF-ES-000190

Severity Override Guidance

The ESM data set rules for SYS1.UADS restrict WRITE or Greater access to only z/OS systems programming personnel.

The ESM data set rules for SYS1.UADS restrict READ and/or UPDATE access to z/OS systems programming personnel and/or security personnel.

The ESM data set rules for SYS1.UADS restrict READ access to auditors as documented in Security Plan.

The ESM data set rules for SYS1.UADS specify that all (i.e., failures and successes) data set access authorities (i.e., READ, UPDATE, ALTER, and CONTROL) will be logged.

If all of the above are untrue, this is not a finding.

If any of the above is true, this is a finding.

Check Content Reference

M

Target Key

4101

Comments