STIGQter STIGQter: STIG Summary: IBM zSecure Suite Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 02 Apr 2025:

Access to IBM Security zSecure installation data sets must be properly restricted and logged.

DISA Rule

SV-259728r1050748_rule

Vulnerability Number

V-259728

Group Title

SRG-APP-000133-MFP-000192

Rule Version

ZSEC-00-000040

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Ensure ALTER access to zSecure installation data sets is restricted to systems programmers, and all failures and successful UPDATE and higher access is logged.

READ access can be permitted to auditors, security administrators (domain level and decentralized), batch jobs that perform ESM maintenance, and trusted STC users.

The installing systems programmer will identify and document the product data sets and categorize them according to who will require UPDATE and higher access and if required that all successful UPDATE and higher access is logged. The installing systems programmer will identify if any additional groups need READ access for specific zSecure installation data sets, and once documented will work with the information system security officer (ISSO) to ensure they are properly restricted to the ESM active on the system.

The following commands are provided as a RACF sample for implementing zSecure installation data set controls. Please convert these commands for any other ESM:

ad 'hlq.zsec.inst.dsn' uacc(none) owner(zSecure owner) -
audit(success(update) failures(read))
pe 'hlq.zsec.inst.dsn' id(AUDTAUDT, SECAAUDT, SECBAUDT, SECDAUDT, TSTCAUDT) access(READ)
pe 'hlq.zsec.inst.dsn' id(SYSPAUDT) access(ALTER)

Check Contents

Verify the accesses to zSecure installation data sets are properly restricted.

- The RACF profile(s) protecting zSecure installation data sets must not allow general access by means of UACC, ID(*), WARNING, or global access.
- The RACF profile(s) protecting zSecure installation data sets must restrict READ access to auditors, security administrators , decentralized security administrators, batch jobs that perform External Security Manager (ESM) maintenance, and trusted STC users.
- The RACF profile(s) protecting zSecure installation data sets must restrict UPDATE and higher access to systems programmers.
- All failures and successful UPDATE and higher access must be logged.

If all of the above restrictions are true, this is not a finding.

Vulnerability Number

V-259728

Documentable

False

Rule Version

ZSEC-00-000040

Severity Override Guidance

Verify the accesses to zSecure installation data sets are properly restricted.

- The RACF profile(s) protecting zSecure installation data sets must not allow general access by means of UACC, ID(*), WARNING, or global access.
- The RACF profile(s) protecting zSecure installation data sets must restrict READ access to auditors, security administrators , decentralized security administrators, batch jobs that perform External Security Manager (ESM) maintenance, and trusted STC users.
- The RACF profile(s) protecting zSecure installation data sets must restrict UPDATE and higher access to systems programmers.
- All failures and successful UPDATE and higher access must be logged.

If all of the above restrictions are true, this is not a finding.

Check Content Reference

M

Target Key

5574