STIGQter: STIG Summary: IBM zSecure Suite Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 02 Apr 2025:

IBM Security zSecure must prevent nonprivileged users from executing privileged zSecure functions.

DISA Rule

SV-259733r1050755_rule

Vulnerability Number

V-259733

Group Title

SRG-APP-000340-MFP-000088

Rule Version

ZSEC-00-000140

Severity

CAT II

CCI(s)

• CCI-002235 - Prevent non-privileged users from executing privileged functions.

Weight

10

Fix Recommendation

Ensure that the following high-level qualifier profiles are defined in the configured zSecure class, by default XFACILIT, with UACC (NONE) and not in WARNING mode:
CKF.**
CKN*.**
CKG.**
CKR.**
C2R.** (if you use zSecure Visual)
C2X.**

A minimum of all failed access must be logged.

The following is an example of RACF commands. Convert these commands for any other ESM:
rdef xfacilit CKF.** uacc(none) owner(zSecure owner)
rdef xfacilit CKN*.** uacc(none) owner(zSecure owner)
rdef xfacilit CKG.** uacc(none) owner(zSecure owner)
rdef xfacilit CKR.** uacc(none) owner(zSecure owner)
rdef xfacilit C2R.** uacc(none) owner(zSecure owner)
rdef xfacilit C2X.** uacc(none) owner(zSecure owner)

Check Contents

If READ access to zSecure functional resources is not restricted to privileged users, this is a finding.
If the following high-level qualifier profiles are defined in the configured zSecure class, by default XFACILIT, with UACC (NONE) and not in WARNING mode, this is not a finding.

CKF.**
CKN*.**
CKG.**
CKR.**
C2R.** (if you use zSecure Visual)
C2X.**

If a minimum of all failed access is logged, this is not a finding.

Vulnerability Number

V-259733

Documentable

False

Rule Version

ZSEC-00-000140

Severity Override Guidance

If READ access to zSecure functional resources is not restricted to privileged users, this is a finding.
If the following high-level qualifier profiles are defined in the configured zSecure class, by default XFACILIT, with UACC (NONE) and not in WARNING mode, this is not a finding.

CKF.**
CKN*.**
CKG.**
CKR.**
C2R.** (if you use zSecure Visual)
C2X.**

If a minimum of all failed access is logged, this is not a finding.

Check Content Reference

M

Target Key

5574