IBM z/OS ACF2 Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-OS-000080-GPOS-00048
Group -
CA-ACF2 must limit Write or greater access to SYS1.LPALIB to system programmers only.
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be...Rule High Severity -
SRG-OS-000080-GPOS-00048
Group -
SRG-OS-000080-GPOS-00048
Group -
CA-ACF2 must limit Write or greater access to Libraries containing EXIT modules to system programmers only.
Access control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, an...Rule High Severity -
SRG-OS-000080-GPOS-00048
Group -
SRG-OS-000080-GPOS-00048
Group -
CA-ACF2 must limit Write or greater access to all LPA libraries to system programmers only.
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be...Rule High Severity -
SRG-OS-000080-GPOS-00048
Group -
SRG-OS-000080-GPOS-00048
Group -
CA-ACF2 must limit Write and allocate access to all system-level product installation libraries to system programmers only.
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be...Rule Medium Severity -
SRG-OS-000080-GPOS-00048
Group -
SRG-OS-000080-GPOS-00048
Group -
CA-ACF2 Access to SYS1.LINKLIB must be properly protected.
If the operating system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part ...Rule Medium Severity -
SRG-OS-000080-GPOS-00048
Group -
SRG-OS-000324-GPOS-00125
Group -
CA-ACF2 LOGONIDs must not be defined to SYS1.UADS for non-emergency use.
Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. Privileg...Rule High Severity -
SRG-OS-000324-GPOS-00125
Group -
IBM z/OS IEASYMUP resource must be protected in accordance with proper security requirements.
Privileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals ...Rule Medium Severity -
SRG-OS-000324-GPOS-00125
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.