CA IDMS must secure the ability to create, alter, drop, grant, and revoke user and/or system profiles to users or groups.

An XCCDF Rule

Description

<VulnDiscussion>Even when using an external security manager (ESM), IDMS system and user profiles which reside in an IDMS user catalog may be assigned to users or groups. The ability to administer user and system profiles must be secured.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-251607r807688_rule
Severity: Medium
References: CCI-001499
Updated: about 1 year ago

The SRTT module must be coded to secure SYSADMIN. When using an ESM, this could be done in the following manner:
 
#SECRTT TYPE=ENTRY,                            X
 RESTYPE=SYSA,                                         X
 SECBY=EXTERNAL ,                                  X
 EXTNAME=(ENVIR,RESTYPE),              X EXTCLS='CA@IDMS'

Using the above example and supposing that was specified ENVNAME=TESTSYS on the INITIAL SRTT entry, the external resource name would be TESTSYS.SYSA. To give access using to a user in Top Secret the command would be:
TSS PER(user_id) CA@IDMS(TESTSYS.SYSA)

After making the above changes, assemble and link RHDCSRTT to create a new SRTT. To implement the new SRTT, either recycle any CVs that use the SRTT or issue these commands:
 
DCMT VARY NUCLEUS MODULE RHDCSRTT NEW COPY 
DCMT VARY NUCLEUS RELOAD

CA IDMS must secure the ability to create, alter, drop, grant, and revoke user and/or system profiles to users or groups.

Description

Remediation - Manual Procedure