The programs that can be run through a CA IDMS CV must be defined to the CV to prevent installation of unauthorized programs; must have the ability to dynamically register new programs; and must have the ability to secure tasks.

An XCCDF Rule

Description

<VulnDiscussion>The IDMS SYSGEN must be protected against unauthorized changes. Satisfies: SRG-APP-000133-DB-000362, SRG-APP-000378-DB-000365</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-251602r855261_rule
Severity: Medium
References: CCI-001499 CCI-001812
Updated: about 1 year ago

The SRTT module must be coded to secure the system. When using an ESM, this could be done in the following manner:
 
#SECRTT TYPE=ENTRY,                          X
 RESTYPE=TASK,                                     X
 SECBY=EXTERNAL ,                               X
 EXTNAME=(RESTYPE,RESNAME),        X  EXTCLS='CA@IDMS'

#SECRTT TYPE=OCCUR,                        X
  RESTYPE=TASK,                                   X
  RESNAME='SYSGEN',                          X
   SECBY=EXT

In the EXTNAME above, RESTYPE is changed to "TASK" and RESNAME is changed to "SYSGEN". 

Ensure the ESM has a corresponding entry to give access to the desired users. For instance, given a system named SYSO187, in Top Secret:
)  
TSS PER(user_id) CA@IDMS(TASK.SYSGEN)

In ACF2:
$KEY(TASK.SYSGEN) TYPE(CA@IDMS) 
 UID(user_id) ALLOW

RDEFINE CA@IDMS SYST UACC(NONE)
PERMIT TASK.SYSGEN CLASS(CA@IDMS) ID(user_id) ACCESS(READ)

After making the above changes, assemble and link RHDCSRTT to create a new SRTT. To implement the new SRTT, either cycle any CVs that use the SRTT or issue these commands:       
 
   DCMT VARY NUCLEUS MODULE RHDCSRTT NEW COPY 
   DCMT VARY NUCLEUS RELOAD

The programs that can be run through a CA IDMS CV must be defined to the CV to prevent installation of unauthorized programs; must have the ability to dynamically register new programs; and must have the ability to secure tasks.

Description

Remediation - Manual Procedure