CICS default logonid(s) must be defined and/or controlled in accordance with the security requirements.

An XCCDF Rule

Description

<VulnDiscussion>CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-224733r904350_rule
Severity: Medium
References: CCI-000764
Updated: 8 months ago

Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required.

Ensure the following items are in effect for the CICS default ACID (i.e., DFLTUSER=default userid): 

1) Not granted the TSS BYPASS privilege. 
2) No access to interactive on-line facilities (e.g., TSO) other than CICS. 

3) OPTIME parameter is set to 15 minutes. can be increased  up to 30 if justified by the ISSM.

4) Restricted from accessing all data sets and resources with the following exceptions: 

  (a) Non-restricted CICS transactions (e.g., CESF, 
       CESN, 'good morning' transaction, etc.). 

  (b) If applicable, resources necessary to operate in an 
       intersystem communication (ISC) environment (i.e., 
       LU6.1, LU6.2, and MRO).

CICS default logonid(s) must be defined and/or controlled in accordance with the security requirements.

Description

Remediation - Manual Procedure