STIGQter: STIG Summary: IBM z/OS RACF Security Technical Implementation Guide Version: 8 Release: 3 Benchmark Date: 23 Apr 2021:

IBM z/OS must specify SMF data options to assure appropriate activation.

DISA Rule

SV-223769r604139_rule

Vulnerability Number

V-223769

Group Title

SRG-OS-000038-GPOS-00016

Rule Version

RACF-OS-000130

Severity

CAT II

CCI(s)

• CCI-000133 - The information system generates audit records containing information that establishes the source of the event.
• CCI-000134 - The information system generates audit records containing information that establishes the outcome of the event.
• CCI-000135 - The information system generates audit records containing the organization-defined additional, more detailed information that is to be included in the audit records.
• CCI-000131 - The information system generates audit records containing information that establishes when an event occurred.
• CCI-000132 - The information system generates audit records containing information that establishes where the event occurred.
• CCI-001464 - The information system initiates session audits at system start-up.
• CCI-001665 - The information system preserves organization-defined system state information in the event of a system failure.

Weight

10

Fix Recommendation

Ensure that collection options for SMF Data are consistent with options specified below.

Review all SMF recording specifications found in SMFPRMxx members. Ensure that SMF recording options used are consistent with those outlined below.

The settings for several parameters are critical to the collection process:

ACTIVE - Activates the collection of SMF data.

MAXDORM(mmss) - Specifies the amount of real time that SMF allows data to remain in an SMF buffer before it is written to a recording data set. Use the MAXDORM parameter to minimize the amount of data lost because of system failure. This value is site determined and should be carefully configured.

SID - Specifies the system ID to be recorded in all SMF records.

SYS(DETAIL) - Controls the level of detail recorded.

SYS(INTERVAL) - Ensures the periodic recording of data for long running jobs.

SYS - Specifies the types and sub types of SMF records that are to be collected. SYS(TYPE) indicates that the supplied list is inclusive (i.e., specifies the record types to be collected). Record types not listed are not collected. SYS(NOTYPE) indicates that the supplied list is exclusive (i.e., specifies those record types not to be collected). Record types not listed are not collected. The site may use either form of this parameter to specify SMF record type collection. However, at a minimum all record types listed.

Check Contents

Refer to IEASYS00 member in SYS1.PARMLIB Concatenation. Determine proper SMFPRMxx member.

If the following SMF collection options are specified as stated below, this is not a finding.

The settings for several parameters are critical to the collection process:

ACTIVE - Activates the collection of SMF data.

MAXDORM - Specifies the amount of real time that SMF allows data to remain in an SMF buffer before it is written to a recording data set. Value is site defined.

SID - Specifies the system ID to be recorded in all SMF records.

SYS(DETAIL) - Controls the level of detail recorded.

SYS(INTERVAL) - Ensures the periodic recording of data for long running jobs.

SYS - Specifies the types and sub types of SMF records that are to be collected. SYS(TYPE) indicates that the supplied list is inclusive (i.e., specifies the record types to be collected). Record types not listed are not collected. SYS(NOTYPE) indicates that the supplied list is exclusive (i.e., specifies those record types not to be collected). Record types listed are not collected. The site may use either form of this parameter to specify SMF record type collection. However, at a minimum all record types listed.

Vulnerability Number

V-223769

Documentable

False

Rule Version

RACF-OS-000130

Severity Override Guidance

Refer to IEASYS00 member in SYS1.PARMLIB Concatenation. Determine proper SMFPRMxx member.

If the following SMF collection options are specified as stated below, this is not a finding.

The settings for several parameters are critical to the collection process:

ACTIVE - Activates the collection of SMF data.

MAXDORM - Specifies the amount of real time that SMF allows data to remain in an SMF buffer before it is written to a recording data set. Value is site defined.

SID - Specifies the system ID to be recorded in all SMF records.

SYS(DETAIL) - Controls the level of detail recorded.

SYS(INTERVAL) - Ensures the periodic recording of data for long running jobs.

SYS - Specifies the types and sub types of SMF records that are to be collected. SYS(TYPE) indicates that the supplied list is inclusive (i.e., specifies the record types to be collected). Record types not listed are not collected. SYS(NOTYPE) indicates that the supplied list is exclusive (i.e., specifies those record types not to be collected). Record types listed are not collected. The site may use either form of this parameter to specify SMF record type collection. However, at a minimum all record types listed.

Check Content Reference

M

Target Key

4101

Comments