WebSphere MQ connection Class resources must be protected in accordance with security.

An XCCDF Rule

Description

WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.

ID: SV-224362r1050674_rule
Version: ZWMQ0052
Severity: Medium
References: CCI-000213 CCI-002234
Updated: about 2 months ago

Remediation Templates

Ensure all connections to MQSeries/WebSphere MQ resources are restricted using connection security.

Ensure the following connection resources defined to TYPE(MQK) (i.e., MQCONNM resource class or MXCONN resource class if SCYCASE is set to MIXED):

Resource       Authorized Users
ssid.BATCH       TSO and batch job useridsssid.CICS       CICS region userids
ssid.IMS       IMS region userids
ssid.CHIN       Channel initiator userids

NOTE: ssid is the queue manager name (a.k.a., subsystem identifier).

For all connection resources defined to TYPE(MQK), ensure the following items are in effect:

Access authorization to these connections restricts access to the appropriate users as indicated above.

All access FAILURE is logged.

Example:

$KEY(ssid) TYPE(MQK)
BATCH UID(STCssid) SERVICE(READ)  
BATCH UID(syspaudt) SERVICE(READ)  
BATCH UID(*) PREVENT 
CHIN UID(STCssidCHIN) SERVICE(READ)  
CHIN UID(*) PREVENT 
CICS UID(*) PREVENT 
IMS UID(*) PREVENT

WebSphere MQ connection Class resources must be protected in accordance with security.

Description

Remediation Templates

A Manual Procedure