STIGQter: STIG Summary: z/OS Front End Processor for RACF Security Technical Implementation Guide Version: 7 Release: 2 Benchmark Date: 01 Oct 2025:

A password control is not in place to restrict access to the service subsystem via the operator consoles (local and/or remote) and a key-lock switch is not used to protect the modem supporting the remote console of the service subsystem.

DISA Rule

SV-224488r1145239_rule

Vulnerability Number

V-224488

Group Title

SRG-OS-000080

Rule Version

ZFEP0016

Severity

CAT II

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

If any of the below procedures are not in place, correct the situation by documenting the missing procedure(s).

The systems programmer should validate that Control authorization to use service subsystem console (local or remote) by FEP internal security control through password validation. Restrict access to these passwords to the absolutely minimum number of necessary personnel. Use of vendor default passwords is prohibited. Assign different passwords for the local and remote consoles. Disconnect the local/remote console after three unsuccessful attempts to log on. Passwords used by vendor (COMTEN, IBM, CNT, or AMDAHL) service personnel will be changed after any maintenance is done. All passwords will be changed every 90 days. Restrict permission to change passwords only to authorized personnel.

Use a key lock switch on the modem supporting the remote console of the service subsystem to prevent unauthorized access. The key lock switch is only open for scheduled and authorized remote access.

Check Contents

Review site documentation to validate that procedures are in place to protect the FEP service subsystem and diskette drive:

Documents and procedures restricting access to the functions of the service subsystem from the local and/or remote operator consoles (e.g., physical access, password control, key-lock switch of modems, etc.). If the following guidance is true, this is not a finding.

Verify password controls are in place to restrict access to the service subsystem via the operator consoles (local and/or remote).

Verify a key-lock switch is used to protect the modem supporting the remote console of the service subsystem.

Verify documents and procedures exist for any of the above functions of the service subsystem and FEP resources.

Vulnerability Number

V-224488

Documentable

False

Rule Version

ZFEP0016

Severity Override Guidance

Review site documentation to validate that procedures are in place to protect the FEP service subsystem and diskette drive:

Documents and procedures restricting access to the functions of the service subsystem from the local and/or remote operator consoles (e.g., physical access, password control, key-lock switch of modems, etc.). If the following guidance is true, this is not a finding.

Verify password controls are in place to restrict access to the service subsystem via the operator consoles (local and/or remote).

Verify a key-lock switch is used to protect the modem supporting the remote console of the service subsystem.

Verify documents and procedures exist for any of the above functions of the service subsystem and FEP resources.

Check Content Reference

M

Target Key

4152