Skip to content
ATO Pathways
Log In
Overview
Search
Catalogs
SCAP
OSCAL
Catalogs
Profiles
Resources
Documents
Publishers
References
Knowledge Base
Platform Documentation
Compliance Dictionary
Platform Changelog
About
Catalogs
XCCDF
zOS Websphere Application Server for TSS Security Technical Implementation Guide
Profiles
III - Administrative Sensitive
III - Administrative Sensitive
An XCCDF Profile
Details
Items
Prose
5 rules organized in 5 groups
SRG-OS-000080
1 Rule
MVS data sets for the WebSphere Application Server are not protected in accordance with the proper security requirements.
Medium Severity
MVS data sets provide the configuration, operational, and executable properties of the WebSphere Application Server (WAS) environment. Failure to properly protect these data sets may lead to unauthorized access. This exposure could compromise the integrity and availability of system services, applications, and customer data.
SRG-OS-000080
1 Rule
HFS objects for the WebSphere Application Server are not protected in accordance with the proper security requirements.
Medium Severity
HFS directories and files provide the configuration, operational, and executable properties of the WebSphere Application Server (WAS) environment. Many of these objects are responsible for the security implementation of WAS. Failure to properly protect these directories and files may lead to unauthorized access. This exposure could potentially compromise the integrity and availability of system services, applications, and customer data.
SRG-OS-000080
1 Rule
The CBIND Resource(s) for the WebSphere Application Server is(are) not protected in accordance with security requirements.
Medium Severity
SAF resources provide the ability to control access to functions and services of the WebSphere Application Server (WAS) environment. Many of these resources provide operational and administrative support for WAS. Failure to properly protect these resources may lead to unauthorized access. This exposure could compromise the integrity and availability of application services and customer data.
SRG-OS-000104
1 Rule
Vendor-supplied user accounts for the WebSphere Application Server must be defined to the ACP.
High Severity
Vendor-supplied user accounts are defined to the ACP with factory-set passwords during the installation of the WebSphere Application Server (WAS). These user accounts are common to all WAS environments and have access to restricted resources and functions. Failure to delete vendor-supplied user accounts from the ACP may lead to unauthorized access. This exposure could compromise the integrity and availability of system services, applications, and customer data.
SRG-OS-000033
1 Rule
The WebSphere Application Server plug-in is not specified in accordance with the proper security requirements.
Medium Severity
Requests processed by the WebSphere Application Server (WAS) are dependent on directives configured in the HTTP server httpd.conf file. These directives specify critical files containing the WAS plug-in and WAS configuration. These files provide the operational and security characteristics of WAS. Failure to properly configure WAS-related directives could lead to undesirable operations and degraded security. This exposure may compromise the availability and integrity of applications and customer data.