All installation-delivered IDMS DEVELOPER-level tasks must be properly secured.

An XCCDF Rule

Description

<VulnDiscussion>Developer-level tasks that are not secured may allow anyone who signs on to IDMS to use them to access and manipulate various resources within the DBMS. Satisfies: SRG-APP-000033-DB-000084, SRG-APP-000211-DB-000122</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-251587r808352_rule
Severity: Medium
References: CCI-000213 CCI-001082
Updated: about 1 year ago

The SRTT module must be coded to enable task-level security. When using an external security manager (ESM), this could be done in the following manner:
 
#SECRTT TYPE=ENTRY,                         X
 RESTYPE=TASK,                                    X
 SECBY=EXTERNAL ,                               X
 EXTNAME=(RESTYPE,RESNAME),        X EXTCLS='CA@IDMS'

or to give access specifically to one or more tasks (in this case, to ADSA):

#SECRTT TYPE=ENTRY, RESTYPE=TASK,                             X
  SECBY=OFF,                                                                        X               
  EXTNAME=(RESTYPE,RESNAME),EXTCLS='CA@IDMS'

with an OCCUR statement for each task:

#SECRTT TYPE=OCCUR,RESTYPE=TASK,                               X
 SECBY=EXTERNAL,                                                                 X 
 RESNAME='ADSA'                                                                           

Using the above examples, the ESM must be configured to grant access for resource name "TASK.task-name" to security group (or role) DEVELOPER, for security class "CA@IDMS", where "task-name" is one of the developer-level tasks listed. 

This grant must be repeated for each Task in the list. These rules should then be given to the appropriate users. For instance, in Top Secret:
TSS PER(user_id) CA@IDMS(TASK.ADSA)  

In ACF2:
$KEY(TASK.ADSA) TYPE(CA@IDMS) 
 UID(user_id) ALLOW

In RACF:
PERMIT TASK.ADSA CLASS(CA@IDMS) ID(user_id) ACCESS(READ)

After making the above changes, assemble and link RHDCSRTT to create a new SRTT. To implement the new SRTT, either recycle any CVs that use the SRTT or issue these commands:       
 
DCMT VARY NUCLEUS MODULE RHDCSRTT NEW COPY 
DCMT VARY NUCLEUS RELOAD

All installation-delivered IDMS DEVELOPER-level tasks must be properly secured.

Description

Remediation - Manual Procedure