STIGQter: STIG Summary: IBM zSecure Suite Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 02 Apr 2025:

The IBM Security zSecure programs CKFCOLL and CKGRACF, and the APF-authorized version of program CKRCARLA, must be restricted to security administrators, security batch jobs performing External Security Manager (ESM) maintenance, auditors, and systems programmers, and must be audited.

DISA Rule

SV-259734r1050758_rule

Vulnerability Number

V-259734

Group Title

SRG-APP-000342-MFP-000090

Rule Version

ZSEC-00-000160

Severity

CAT II

CCI(s)

• CCI-002233 - Prevent the organization-defined software from executing at higher privilege levels than users executing the software.
• CCI-002234 - Log the execution of privileged functions.

Weight

10

Fix Recommendation

The following commands are provided as a sample for implementing RACF zSecure user data set controls. Convert these commands for any other ESM:

rdef program CKFCOLL uacc(none) owner(zSecure owner) audit(all(read))
pe CKFCOLL class(program) id(AUDTAUDT, SECAAUDT, SECBAUDT,
SECDAUDT, SYSPAUDT) access(READ)
rdef program CKGRACF uacc(none) owner(zSecure owner) audit(all(read))
pe CKGRACF class(program) id(AUDTAUDT, SECAAUDT, SECBAUDT,
SECDAUDT, SYSPAUDT) access(READ)
rdef program CKRCARLX uacc(none) owner(zSecure owner) audit(all(read))
pe CKRCARLX class(program) id(AUDTAUDT, SECAAUDT, SECBAUDT,
SECDAUDT, SYSPAUDT) access(READ)

Check Contents

If this is not a RACF system, the presence of CKGRACF is not applicable.

Verify the access and log settings of the profiles that protect the use of the CKFCOLL and CKGRACF programs and the APF-authorized version of the CKRCARLA program.

If the CKF.** and CKG.** profiles that protect the use of the CKFCOLL, CKGRACF, and CKRCARLA programs allow general access (UACC, ID(*), WARNING, or global access) or do not log successful READ access, this is a finding.

If READ or higher access to profile(s) protecting CKF.** resources in XFACILIT class is not restricted to security administrators (domain or decentralized), batch jobs performing ESM maintenance, auditors, or systems programmers, this is a finding.

If READ or higher access to profile(s) protecting CKG.** resources in XFACILIT class is not restricted to security administrators (domain or decentralized) or batch jobs performing ESM maintenance, this is a finding.

Review auditing of the profile protecting the CKR.CKRCARLA.APF resource in XFACILIT class.

If successful READs are not audited, this is a finding.

Vulnerability Number

V-259734

Documentable

False

Rule Version

ZSEC-00-000160

Severity Override Guidance

If this is not a RACF system, the presence of CKGRACF is not applicable.

Verify the access and log settings of the profiles that protect the use of the CKFCOLL and CKGRACF programs and the APF-authorized version of the CKRCARLA program.

If the CKF.** and CKG.** profiles that protect the use of the CKFCOLL, CKGRACF, and CKRCARLA programs allow general access (UACC, ID(*), WARNING, or global access) or do not log successful READ access, this is a finding.

If READ or higher access to profile(s) protecting CKF.** resources in XFACILIT class is not restricted to security administrators (domain or decentralized), batch jobs performing ESM maintenance, auditors, or systems programmers, this is a finding.

If READ or higher access to profile(s) protecting CKG.** resources in XFACILIT class is not restricted to security administrators (domain or decentralized) or batch jobs performing ESM maintenance, this is a finding.

Review auditing of the profile protecting the CKR.CKRCARLA.APF resource in XFACILIT class.

If successful READs are not audited, this is a finding.

Check Content Reference

M

Target Key

5574