Skip to content
ATO Pathways
  Log In

III - Administrative Sensitive

Rules and Groups employed by this XCCDF Profile

  • SRG-OS-000134-GPOS-00068

    <GroupDescription></GroupDescription>
    Group
    Show

  • CA VM:Secure must have a security group for Security Administrators only.

    &lt;VulnDiscussion&gt;An isolation boundary provides access control and protects the integrity of the hardware, software, and firmware that perform...
    Rule Medium Severity
    Show

  • SRG-OS-000138-GPOS-00069

    <GroupDescription></GroupDescription>
    Group
    Show

  • The IBM z/VM SYSTEM CONFIG file must be configured to clear TDISK on IPL.

    &lt;VulnDiscussion&gt;Preventing unauthorized information transfers mitigates the risk of information, including encrypted representations of infor...
    Rule Medium Severity
    Show

  • SRG-OS-000142-GPOS-00071

    <GroupDescription></GroupDescription>
    Group
    Show

  • The IBM z/VM TCP/IP FOREIGNIPCONLIMIT statement must be properly configured.

    &lt;VulnDiscussion&gt;DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot ac...
    Rule Medium Severity
    Show

  • SRG-OS-000142-GPOS-00071

    <GroupDescription></GroupDescription>
    Group
    Show

  • The IBM z/VM TCP/IP PERSISTCONNECTIONLIMIT statement must be properly configured.

    &lt;VulnDiscussion&gt;DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot ac...
    Rule Medium Severity
    Show

  • SRG-OS-000142-GPOS-00071

    <GroupDescription></GroupDescription>
    Group
    Show

  • The IBM z/VM TCP/IP PENDINGCONNECTIONLIMIT statement must be properly configured.

    &lt;VulnDiscussion&gt;DoS is a condition when a resource is not available for legitimate users. When this occurs, the organization either cannot ac...
    Rule Medium Severity
    Show

  • SRG-OS-000185-GPOS-00079

    <GroupDescription></GroupDescription>
    Group
    Show

  • IBM z/VM tapes must use Tape Encryption.

    &lt;VulnDiscussion&gt;Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive and...
    Rule Medium Severity
    Show

  • SRG-OS-000228-GPOS-00088

    <GroupDescription></GroupDescription>
    Group
    Show

  • The IBM z/VM TCP/IP must be configured to display the mandatory DoD Notice and Consent banner before granting access to the system.

    &lt;VulnDiscussion&gt;Display of a standardized and approved use notification before granting access to the publicly accessible operating system en...
    Rule Medium Severity
    Show

  • SRG-OS-000254-GPOS-00095

    <GroupDescription></GroupDescription>
    Group
    Show

  • The IBM z/VM JOURNALING statement must be coded on the configuration file.

    &lt;VulnDiscussion&gt;If auditing is enabled late in the start-up process, the actions of some start-up processes may not be audited. Some audit sy...
    Rule Medium Severity
    Show

  • SRG-OS-000256-GPOS-00097

    <GroupDescription></GroupDescription>
    Group
    Show

  • CA VM:Secure product SECURITY CONFIG file must be restricted to appropriate personnel.

    &lt;VulnDiscussion&gt;Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefo...
    Rule Medium Severity
    Show

  • SRG-OS-000257-GPOS-00098

    <GroupDescription></GroupDescription>
    Group
    Show

  • The IBM z/VM AUDT and Journal Mini Disks must be restricted to the appropriate system administrators.

    &lt;VulnDiscussion&gt;Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data. Therefo...
    Rule Medium Severity
    Show

  • SRG-OS-000123-GPOS-00064

    <GroupDescription></GroupDescription>
    Group
    Show

  • IBM z/VM must remove or disable emergency accounts after the crisis is resolved or 72 hours.

    &lt;VulnDiscussion&gt;Emergency accounts are privileged accounts that are established in response to crisis situations where the need for rapid acc...
    Rule Medium Severity
    Show

  • SRG-OS-000259-GPOS-00100

    <GroupDescription></GroupDescription>
    Group
    Show

  • The IBM z/VM must restrict link access to the disk on which system software resides.

    &lt;VulnDiscussion&gt;If the operating system were to allow any user to make changes to software libraries, then those changes might be implemented...
    Rule Medium Severity
    Show

  • SRG-OS-000362-GPOS-00149

    <GroupDescription></GroupDescription>
    Group
    Show

  • The IBM z/VM Privilege command class A and Class B must be properly assigned.

    &lt;VulnDiscussion&gt;Allowing regular users to install software, without explicit privileges, creates the risk that untested or potentially malici...
    Rule Medium Severity
    Show

  • SRG-OS-000364-GPOS-00151

    <GroupDescription></GroupDescription>
    Group
    Show

  • CA VM:Secure AUTHORIZ CONFIG file must be properly configured.

    &lt;VulnDiscussion&gt;Failure to provide logical access restrictions associated with changes to system configuration may have significant effects o...
    Rule Medium Severity
    Show

  • SRG-OS-000341-GPOS-00132

    <GroupDescription></GroupDescription>
    Group
    Show

  • The IBM z/VM journal minidisk space allocation must be large enough for one weeks worth of audit records.

    &lt;VulnDiscussion&gt;In order to ensure operating systems have a sufficient storage capacity in which to write the audit logs, operating systems n...
    Rule Medium Severity
    Show

  • SRG-OS-000342-GPOS-00133

    <GroupDescription></GroupDescription>
    Group
    Show

  • CA VM:Secure product audit records must offload audit records to a different system or media.

    &lt;VulnDiscussion&gt;Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common...
    Rule Medium Severity
    Show

  • SRG-OS-000479-GPOS-00224

    <GroupDescription></GroupDescription>
    Group
    Show

  • CA VM:Secure product audit records must be offloaded on a weekly basis.

    &lt;VulnDiscussion&gt;Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common...
    Rule Medium Severity
    Show

  • SRG-OS-000379-GPOS-00164

    <GroupDescription></GroupDescription>
    Group
    Show

  • The IBM z/VM Portmapper server virtual machine userID must be included in the AUTOLOG statement of the TCP/IP server configuration file.

    &lt;VulnDiscussion&gt;Without authenticating devices, unidentified or unknown devices may be introduced, thereby facilitating malicious activity. B...
    Rule Medium Severity
    Show

  • SRG-OS-000312-GPOS-00124

    <GroupDescription></GroupDescription>
    Group
    Show

  • CA VM:Secure product MANAGE command must be restricted to system administrators.

    &lt;VulnDiscussion&gt;Discretionary Access Control (DAC) is based on the notion that individual users are "owners" of objects and therefore have di...
    Rule Medium Severity
    Show

  • SRG-OS-000326-GPOS-00126

    <GroupDescription></GroupDescription>
    Group
    Show

  • The CA VM:Secure LOGONBY command must be restricted to system administrators.

    &lt;VulnDiscussion&gt;In certain situations, software applications/programs need to execute with elevated privileges to perform required functions....
    Rule Medium Severity
    Show

  • SRG-OS-000324-GPOS-00125

    <GroupDescription></GroupDescription>
    Group
    Show

  • The IBM z/VM CP Privilege Class A, B, and D must be restricted to appropriate system operators.

    &lt;VulnDiscussion&gt;Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or proce...
    Rule Medium Severity
    Show

  • SRG-OS-000329-GPOS-00128

    <GroupDescription></GroupDescription>
    Group
    Show

  • The IBM z/VM JOURNALING statement must be properly configured.

    &lt;VulnDiscussion&gt;By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise...
    Rule Medium Severity
    Show

  • SRG-OS-000425-GPOS-00189

    <GroupDescription></GroupDescription>
    Group
    Show

  • The IBM z/VM TCP/IP SECUREDATA option for FTP must be set to REQUIRED.

    &lt;VulnDiscussion&gt;Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, for examp...
    Rule Medium Severity
    Show

  • SRG-OS-000297-GPOS-00115

    <GroupDescription></GroupDescription>
    Group
    Show

  • IBM z/VM TCP/IP config file INTERNALCLIENTPARMS statement must be properly configured.

    &lt;VulnDiscussion&gt;Remote access services, such as those providing remote access to network devices and information systems, which lack automate...
    Rule Medium Severity
    Show

  • SRG-OS-000425-GPOS-00189

    <GroupDescription></GroupDescription>
    Group
    Show

  • All IBM z/VM TCP/IP servers must be configured for SSL/TLS connection.

    &lt;VulnDiscussion&gt;Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, for examp...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules