CICS userids are not defined and/or controlled in accordance with proper security requirements.
An XCCDF Rule
Description
CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.
- ID
- SV-224736r958472_rule
- Version
- ZCICT041
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Ensure the CICS region is defined to the PROPCNTL resource class.
Example:
TSS ADDTO(owning acid) PROPCNTL(CICS region acid)