STIGQter: STIG Summary: IBM z/OS TSS Security Technical Implementation Guide Version: 8 Release: 2 Benchmark Date: 23 Apr 2021:

The IBM z/OS IEASYMUP resource must be protected in accordance with proper security requirements.

DISA Rule

SV-223965r561402_rule

Vulnerability Number

V-223965

Group Title

SRG-OS-000324-GPOS-00125

Rule Version

TSS0-ES-000920

Severity

CAT II

CCI(s)

• CCI-002235 - The information system prevents non-privileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

Weight

10

Fix Recommendation

Ensure that the System level symbolic resources are defined to the FACILITY resource class and protected. UPDATE access to the System level symbolic resources are limited to System Programmers, DASD Administrators, and/or Tape Library personnel. All access is logged. Ensure the guidelines for the resources and/or generic equivalent are followed.

Limit access to the IEASYMUP resources to above personnel with UPDATE and/or greater access.

The following commands are provided as a sample for implementing resource controls:

TSS ADD(ADMIN) IBMFAC(IEASYMUP)

TSS PERMIT(<dasdsmpl>) IBMFAC(IEASYMUP) ACC(U) ACTION(AUDIT)
TSS PERMIT(<syspsmpl>) IBMFAC(IEASYMUP) ACC(U) ACTION(AUDIT)
TSS PERMIT(<tapesmpl>) IBMFAC(IEASYMUP) ACC(U) ACTION(AUDIT)

Check Contents

From the ISPF Command Shell enter:
TSS WHOOWNS IBMFAC(IEASYMUP)

If the TSS resources are owned or DEFPROT is specified for the resource class, this is not a finding.

Enter
TSS WHOHAS IBMFAC(IEASYMUP)

If TSS resource access authorizations restrict UPDATE and/or greater access to DASD administrators, Tape Library personnel, and system programming personnel, this is not a finding.

Vulnerability Number

V-223965

Documentable

False

Rule Version

TSS0-ES-000920

Severity Override Guidance

From the ISPF Command Shell enter:
TSS WHOOWNS IBMFAC(IEASYMUP)

If the TSS resources are owned or DEFPROT is specified for the resource class, this is not a finding.

Enter
TSS WHOHAS IBMFAC(IEASYMUP)

If TSS resource access authorizations restrict UPDATE and/or greater access to DASD administrators, Tape Library personnel, and system programming personnel, this is not a finding.

Check Content Reference

M

Target Key

4102

Comments