STIGQter: STIG Summary: z/OS ROSCOE for ACF2 STIG Version: 6 Release: 7 Benchmark Date: 20 Jan 2015:

The ROSCOE's Resouce Class is not defined or active in the ACP.

DISA Rule

SV-24845r1_rule

Vulnerability Number

V-18011

Group Title

ZB000038

Rule Version

ZROSA038

Severity

CAT II

CCI(s)

• CCI-000336 - The organization, after the information system is changed, checks the security functions to verify the functions are operating as intended.
• CCI-002358 - The information system implements a reference monitor for organization-defined access control policies that is always invoked.

Weight

10

Fix Recommendation

The IAO will use SAF security to define and protect the Products resouce class(es).

Ensure that the following GSO CLASMAP record entry(ies) is (are) defined:

CLASMAP.ROSCOE ENTITYLN(39) RESOURCE(ROSRES) RSRCTYPE(ROS)

Example:

SET C(GSO)
LIST CLASMAP.ROSCOE
INSERT CLASMAP.ROSCOE ENTITYLN(39) RESOURCE(ROSRES) RSRCTYPE(ROS)

F ACF2,REFRESH(CLASMAP)

Check Contents

a) Refer to the following report produced by the ACF2 Data Collection:

- ACF2CMDS.RPT(ACFGSO)

b) Ensure that the following GSO CLASMAP record entries are defined:

CLASMAPqual RESOURCE(ROSRES) RSRCTYPE(ROS)

c) If all of the items in (b) are true, there is NO FINDING.

d) If any item in (b) is untrue, this is a FINDING.

Vulnerability Number

V-18011

Documentable

False

Rule Version

ZROSA038

Severity Override Guidance

a) Refer to the following report produced by the ACF2 Data Collection:

- ACF2CMDS.RPT(ACFGSO)

b) Ensure that the following GSO CLASMAP record entries are defined:

CLASMAPqual RESOURCE(ROSRES) RSRCTYPE(ROS)

c) If all of the items in (b) are true, there is NO FINDING.

d) If any item in (b) is untrue, this is a FINDING.

Check Content Reference

M

Responsibility

Information Assurance Manager

Target Key

1665

Comments