STIGQter: STIG Summary: z/OS NetView for ACF2 Security Technical Implementation Guide Version: 7 Release: 2 Benchmark Date: 01 Oct 2025: STIGQter: STIG Summary: z/OS NetView for ACF2 Security Technical Implementation Guide Version: 7 Release: 2 Benchmark Date: 01 Oct 2025:SV-224327r1141608_rule
V-224327
SRG-OS-000018
ZNET0040
CAT II
10
The systems programmer and ISSO will review NetView configuration parameters and control options for compliance.
To ensure authentication of users to NetView, ensure that CxxSTYLE in the DSIPARM DD statement concatenation of the NetView CNMPROC STC procedure has the following initialization parameter(s) specified:
(Note: The dataset identified above is an example of a possible installation. The dataset is determined when the product is installed on a system through the product's installation guide and can be site specific.)
SECOPTS.OPERSEC=SAFCHECK|SAFDEF
When SECOPTS.OPERSEC=SAFCHECK is used, it specifies that operator identification and password or password phrase checking is performed using an SAF security product. The operator identifier must also be defined in DSIOPF, and other attributes given to the operator at logon are taken from the specified profile for the operator in DSIPRF.
Security access checks are checked against the authority of the operator that occur when an operator tries to access a dataset that is protected in the DATASET class of an SAF product or an MVS system command that is protected in the OPERCMDS class of an SAF product.
When SECOPTS.OPERSEC=SAFDEF is used, it specifies that operator identification and password or password phrase checking is done using an SAF security product. Authority to log on as a NetView operator is controlled through the APPL class. The operator identifier must be authorized to the resource name in the APPL class that represents the NetView program.
The attributes given to the operator at logon are defined in the NETVIEW segment of the user profile for the operator in the SAF product. For more information, refer to IBM Tivoli NetView for z/OS Security Reference.
When SECOPTS.OPERSEC=SAFDEF is specified, any value for SECOPTS.CMDAUTH can be used.
Additional details can be obtained in the IBM Tivoli NetView for z/OS Security Reference.
SECOPTS.CMDAUTH=SAF.FAIL|SAF.table
When SECOPTS.CMDAUTH=SAF.table is used, the table specifies the backup table to be used for immediate commands and when the SAF product cannot make a security decision. This can occur when:
No resource name is defined in the NETCMDS class that protects or authorizes this command.
The NETCMDS class is not active.
The security product is not active.
When SECOPTS.CMDAUTH=SAF.FAIL is used, command authority checking will fail if the SAF product can reach no decision.
Additional details can be obtained in the IBM Tivoli NetView for z/OS Administration Reference.
Review the member CxxSTYLE in the DSIPARM DD statement concatenation of the NetView CNMPROC STC procedure.
Automated Analysis
Refer to the following report produced by the dataset and Resource Data Collection:
- PDI(ZNET0040).
Verify that all NetView configuration requirements are specified. If the following guidance is true, this is not a finding.
Keyword Value
SECOPTS.OPERSEC SAFCHECK|SAFDEF
SECOPTS.CMDAUTH SAF.FAIL|SAF.table
V-224327
False
ZNET0040
Review the member CxxSTYLE in the DSIPARM DD statement concatenation of the NetView CNMPROC STC procedure.
Automated Analysis
Refer to the following report produced by the dataset and Resource Data Collection:
- PDI(ZNET0040).
Verify that all NetView configuration requirements are specified. If the following guidance is true, this is not a finding.
Keyword Value
SECOPTS.OPERSEC SAFCHECK|SAFDEF
SECOPTS.CMDAUTH SAF.FAIL|SAF.table
M
4126