I - Mission Critical Classified
Rules and Groups employed by this XCCDF Profile
-
SRG-OS-000080-GPOS-00048
Group -
CA-ACF2 must limit Write or greater access to SYS1.NUCLEUS to system programmers only.
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be...Rule High Severity -
SRG-OS-000080-GPOS-00048
Group -
CA-ACF2 must limit Write or greater access to SYS1.LPALIB to system programmers only.
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be...Rule High Severity -
SRG-OS-000080-GPOS-00048
Group -
CA-ACF2 must limit Write or greater access to SYS1.IMAGELIB to system programmers.
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be...Rule High Severity -
SRG-OS-000080-GPOS-00048
Group -
CA-ACF2 must limit Write or greater access to Libraries containing EXIT modules to system programmers only.
Access control policies include: identity-based policies, role-based policies, and attribute-based policies. Access enforcement mechanisms include: access control lists, access control matrices, an...Rule High Severity -
SRG-OS-000080-GPOS-00048
Group -
CA-ACF2 must limit Write and Allocate access to all APF-authorized libraries to system programmers only.
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be...Rule High Severity -
SRG-OS-000080-GPOS-00048
Group -
CA-ACF2 must limit Write or greater access to all LPA libraries to system programmers only.
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be...Rule High Severity -
SRG-OS-000080-GPOS-00048
Group -
CA-ACF2 must limit Write and Allocate access to LINKLIST libraries to system programmers only.
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be...Rule Medium Severity -
SRG-OS-000080-GPOS-00048
Group -
CA-ACF2 must limit Write and allocate access to all system-level product installation libraries to system programmers only.
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be...Rule Medium Severity -
SRG-OS-000080-GPOS-00048
Group -
CA-ACF2 must limit Write or greater access to SYS1.SVCLIB to system programmers only.
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be...Rule High Severity -
SRG-OS-000080-GPOS-00048
Group -
CA-ACF2 Access to SYS1.LINKLIB must be properly protected.
If the operating system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part ...Rule Medium Severity -
SRG-OS-000080-GPOS-00048
Group -
CA-ACF2 must limit access to data sets used to back up and/or dump SMF collection files to appropriate users and/or batch jobs that perform SMF dump processing.
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be...Rule Medium Severity -
SRG-OS-000324-GPOS-00125
Group -
CA-ACF2 LOGONIDs must not be defined to SYS1.UADS for non-emergency use.
Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. Privileg...Rule High Severity -
SRG-OS-000324-GPOS-00125
Group -
IBM z/OS IEASYMUP resource must be protected in accordance with proper security requirements.
Privileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals ...Rule Medium Severity -
SRG-OS-000324-GPOS-00125
Group -
CA-ACF2 must limit Update and Allocate access to system backup files to system programmers and/or batch jobs that perform DASD backups.
Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. Privileg...Rule Medium Severity -
SRG-OS-000324-GPOS-00125
Group -
ACF2 PPGM GSO record value must specify protected programs that are only executed by privileged users.
Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. Privileg...Rule Medium Severity -
SRG-OS-000329-GPOS-00128
Group -
The CA-ACF2 PSWD GSO record values for MAXTRY and PASSLMT must be properly set.
By limiting the number of failed logon attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced. Limits are imposed by locking the a...Rule Medium Severity -
SRG-OS-000063-GPOS-00032
Group -
IBM z/OS SYS1.PARMLIB must be properly protected.
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems (e.g., web servers and web portals) must be...Rule High Severity -
SRG-OS-000364-GPOS-00151
Group -
CA-ACF2 must be installed, functional, and properly configured.
Failure to provide logical access restrictions associated with changes to system configuration may have significant effects on the overall security of the system. When dealing with access restrict...Rule High Severity -
SRG-OS-000080-GPOS-00048
Group -
CA-ACF2 must limit Write and allocate access to the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) to system programmers only.
To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved PKIs, all DoD systems (e.g., web servers and web portals) must be...Rule Medium Severity -
SRG-OS-000080-GPOS-00048
Group -
CA-ACF2 must limit Write or greater access to libraries that contain PPT modules to system programmers only.
If the operating system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part ...Rule Low Severity -
SRG-OS-000480-GPOS-00227
Group -
The EXITS GSO record value must specify the module names of site written ACF2 exit routines.
Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security ba...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
The CA-ACF2 LOGONID with the REFRESH attribute must have procedures for utilization.
Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security ba...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
IBM z/OS TSO GSO record values must be set to the values specified.
Configuring the operating system to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security ba...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
IBM z/OS procedures must restrict ACF2 LOGONIDs with the READALL attribute to auditors and/or authorized users.
The use of security policy filters provides protection for the confidentiality of data by restricting the flow of data. A crucial part of any flow control solution is the ability to configure polic...Rule Medium Severity -
SRG-OS-000480-GPOS-00227
Group -
IBM z/OS must have the RULEVLD and RSRCVLD attributes specified for LOGONIDs with the SECURITY attribute.
The use of security policy filters provides protection for the confidentiality of data by restricting the flow of data. A crucial part of any flow control solution is the ability to configure polic...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.