CICS logonid(s) must have time-out limit set to 15 minutes.
An XCCDF Rule
Description
<VulnDiscussion>CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS region userids may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data. RACF provides the PROPCNTL class to prevent userids such as the CICS region userid from being propagated/used by unauthorized userids.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-224497r868330_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required.
Ensure that all userids with a CICS segment have the TIMEOUT parameter set to 15 minutes.
Examples: Use the RACF ALtUser command to assign the required value: