kriterion 0.0.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +7 -0
- data/.gitignore +2 -0
- data/.ruby-version +1 -0
- data/.travis.yml +5 -0
- data/Dockerfile +18 -0
- data/Gemfile +12 -0
- data/Gemfile.lock +62 -0
- data/LICENSE.txt +21 -0
- data/README.md +58 -0
- data/Rakefile +6 -0
- data/bin/setup +8 -0
- data/bin/update_stigs.rb +42 -0
- data/criterion.gemspec +31 -0
- data/docker-compose.yml +14 -0
- data/exe/kriterion +16 -0
- data/lib/kriterion.rb +16 -0
- data/lib/kriterion/api.rb +27 -0
- data/lib/kriterion/backend.rb +13 -0
- data/lib/kriterion/backend/mongodb.rb +235 -0
- data/lib/kriterion/cli.rb +28 -0
- data/lib/kriterion/cli/api.rb +35 -0
- data/lib/kriterion/cli/worker.rb +35 -0
- data/lib/kriterion/event.rb +36 -0
- data/lib/kriterion/item.rb +42 -0
- data/lib/kriterion/logs.rb +14 -0
- data/lib/kriterion/metrics.rb +22 -0
- data/lib/kriterion/object.rb +50 -0
- data/lib/kriterion/report.rb +69 -0
- data/lib/kriterion/resource.rb +60 -0
- data/lib/kriterion/section.rb +32 -0
- data/lib/kriterion/standard.rb +65 -0
- data/lib/kriterion/version.rb +3 -0
- data/lib/kriterion/worker.rb +280 -0
- data/standards/cis_red_hat_enterprise_linux_7.json +34 -0
- data/standards/stig_a10_networks_adc_alg.json +209 -0
- data/standards/stig_a10_networks_adc_ndm.json +233 -0
- data/standards/stig_active_directory_domain.json +257 -0
- data/standards/stig_active_directory_forest.json +41 -0
- data/standards/stig_active_directory_service_2003.json +173 -0
- data/standards/stig_active_directory_service_2008.json +167 -0
- data/standards/stig_adobe_acrobat_pro_xi.json +167 -0
- data/standards/stig_adobe_acrobat_reader_dc_classic_track.json +179 -0
- data/standards/stig_adobe_acrobat_reader_dc_continuous_track.json +179 -0
- data/standards/stig_adobe_coldfusion_11.json +611 -0
- data/standards/stig_airwatch_mdm.json +185 -0
- data/standards/stig_aix_5.3.json +3095 -0
- data/standards/stig_aix_6.1.json +3047 -0
- data/standards/stig_akamai_ksd_service_impact_level_2_alg.json +209 -0
- data/standards/stig_akamai_ksd_service_impact_level_2_ndm.json +155 -0
- data/standards/stig_android_2.2_dell.json +311 -0
- data/standards/stig_apache_2.2_serverwindows.json +347 -0
- data/standards/stig_apache_2.2_sitewindows_security_implementation_guide.json +179 -0
- data/standards/stig_apache_server_2.0unix.json +341 -0
- data/standards/stig_apache_server_2.0windows.json +341 -0
- data/standards/stig_apache_server_2.2unix.json +347 -0
- data/standards/stig_apache_server_2.2windows.json +347 -0
- data/standards/stig_apache_site_2.0unix.json +185 -0
- data/standards/stig_apache_site_2.0windows.json +179 -0
- data/standards/stig_apache_site_2.2unix.json +185 -0
- data/standards/stig_apache_site_2.2windows.json +179 -0
- data/standards/stig_apple_ios6.json +341 -0
- data/standards/stig_apple_ios_10.json +245 -0
- data/standards/stig_apple_ios_11.json +269 -0
- data/standards/stig_apple_ios_4_good_mobility_suite_interim_security_configuration_guide_iscg.json +257 -0
- data/standards/stig_apple_ios_5.json +329 -0
- data/standards/stig_apple_ios_6.json +335 -0
- data/standards/stig_apple_ios_6_interim_security_configuration_guide_iscg.json +371 -0
- data/standards/stig_apple_ios_7.json +185 -0
- data/standards/stig_apple_ios_8_interim_security_configuration_guide.json +251 -0
- data/standards/stig_apple_ios_9_interim_security_configuration_guide.json +245 -0
- data/standards/stig_apple_os_x_10.10_yosemite_workstation.json +851 -0
- data/standards/stig_apple_os_x_10.11.json +725 -0
- data/standards/stig_apple_os_x_10.12.json +737 -0
- data/standards/stig_apple_os_x_10.8_mountain_lion_workstation.json +1241 -0
- data/standards/stig_apple_os_x_10.9_mavericks_workstation.json +809 -0
- data/standards/stig_application_layer_gateway_alg_security_requirements_guide_srg.json +911 -0
- data/standards/stig_application_layer_gateway_security_requirements_guide.json +911 -0
- data/standards/stig_application_security_and_development.json +1745 -0
- data/standards/stig_application_security_and_development_checklist.json +959 -0
- data/standards/stig_application_security_requirements_guide.json +1961 -0
- data/standards/stig_application_server_security_requirements_guide.json +791 -0
- data/standards/stig_arcgisserver_10.3.json +143 -0
- data/standards/stig_arista_mls_dcs-7000_series_l2s.json +53 -0
- data/standards/stig_arista_mls_dcs-7000_series_ndm.json +197 -0
- data/standards/stig_arista_mls_dcs-7000_series_rtr.json +143 -0
- data/standards/stig_bind_9.x.json +431 -0
- data/standards/stig_bind_dns.json +317 -0
- data/standards/stig_blackberry_10.2.x_os.json +179 -0
- data/standards/stig_blackberry_10_os.json +227 -0
- data/standards/stig_blackberry_bes_12.3.x_mdm.json +65 -0
- data/standards/stig_blackberry_bes_12.5.x_mdm.json +65 -0
- data/standards/stig_blackberry_device_service_6.2.json +425 -0
- data/standards/stig_blackberry_enterprise_mobility_server_2.x.json +149 -0
- data/standards/stig_blackberry_enterprise_server,_part_1.json +35 -0
- data/standards/stig_blackberry_enterprise_server,_part_2.json +155 -0
- data/standards/stig_blackberry_enterprise_server,_part_3.json +647 -0
- data/standards/stig_blackberry_enterprise_server_version_5.x,_part_1.json +35 -0
- data/standards/stig_blackberry_enterprise_server_version_5.x,_part_2.json +155 -0
- data/standards/stig_blackberry_enterprise_server_version_5.x,_part_3.json +653 -0
- data/standards/stig_blackberry_enterprise_service_v10.1.x_blackberry_device_service.json +317 -0
- data/standards/stig_blackberry_enterprise_service_v10.2.x_blackberry_device_service.json +263 -0
- data/standards/stig_blackberry_handheld_device.json +125 -0
- data/standards/stig_blackberry_os_10.3.x.json +257 -0
- data/standards/stig_blackberry_os_7.x.json +107 -0
- data/standards/stig_blackberry_os_7.x.x.json +101 -0
- data/standards/stig_blackberry_os_version_5-7.json +107 -0
- data/standards/stig_blackberry_playbook.json +65 -0
- data/standards/stig_blackberry_playbook_os_nea_mode.json +65 -0
- data/standards/stig_blackberry_playbook_os_v2.1.json +197 -0
- data/standards/stig_blackberry_uem_12.7.json +59 -0
- data/standards/stig_bluetoothzigbee.json +35 -0
- data/standards/stig_ca_api_gateway_alg.json +497 -0
- data/standards/stig_cisco_css_dns.json +71 -0
- data/standards/stig_cisco_ios_xe_release_3_ndm.json +395 -0
- data/standards/stig_cisco_ios_xe_release_3_rtr.json +149 -0
- data/standards/stig_cmd_management_server_policy.json +53 -0
- data/standards/stig_commercial_mobile_device_cmd_policy.json +83 -0
- data/standards/stig_csfc_campus_wlan_policy_security_implementation_guide.json +95 -0
- data/standards/stig_database_security_requirements_guide.json +767 -0
- data/standards/stig_dbn-6300_idps.json +107 -0
- data/standards/stig_dbn-6300_ndm.json +359 -0
- data/standards/stig_defense_switched_network.json +683 -0
- data/standards/stig_defense_switched_network_dsn.json +653 -0
- data/standards/stig_desktop_applications_general.json +41 -0
- data/standards/stig_dns_policy.json +155 -0
- data/standards/stig_domain_name_system_dns_security_requirements_guide.json +599 -0
- data/standards/stig_draft_aix.json +3503 -0
- data/standards/stig_edb_postgres_advanced_server.json +665 -0
- data/standards/stig_email_services_policy.json +137 -0
- data/standards/stig_exchange_2010_client_access_server.json +179 -0
- data/standards/stig_exchange_2010_edge_transport_server.json +389 -0
- data/standards/stig_exchange_2010_hub_transport_server.json +269 -0
- data/standards/stig_exchange_2010_mailbox_server.json +209 -0
- data/standards/stig_f5_big-ip_access_policy_manager_11.x.json +149 -0
- data/standards/stig_f5_big-ip_advanced_firewall_manager_11.x.json +41 -0
- data/standards/stig_f5_big-ip_application_security_manager_11.x.json +89 -0
- data/standards/stig_f5_big-ip_device_management_11.x.json +467 -0
- data/standards/stig_f5_big-ip_local_traffic_manager_11.x.json +407 -0
- data/standards/stig_final_draft_general_wireless_policy.json +71 -0
- data/standards/stig_firewall.json +449 -0
- data/standards/stig_firewall_-_cisco.json +449 -0
- data/standards/stig_firewall_security_requirements_guide.json +257 -0
- data/standards/stig_forescout_counteract_alg.json +83 -0
- data/standards/stig_forescout_counteract_ndm.json +239 -0
- data/standards/stig_free_space_optics_device.json +143 -0
- data/standards/stig_general_mobile_device_policy_non-enterprise_activated.json +113 -0
- data/standards/stig_general_mobile_device_technical_non-enterprise_activated.json +59 -0
- data/standards/stig_general_purpose_operating_system_srg.json +1199 -0
- data/standards/stig_general_wireless_policy.json +71 -0
- data/standards/stig_good_mobility_suite_server_android_os.json +203 -0
- data/standards/stig_good_mobility_suite_server_apple_ios_4_interim_security_configuration_guide_iscg.json +209 -0
- data/standards/stig_good_mobility_suite_server_windows_phone_6.5.json +449 -0
- data/standards/stig_goodenterprise_8.x.json +401 -0
- data/standards/stig_google_chrome_browser.json +209 -0
- data/standards/stig_google_chrome_current_windows.json +215 -0
- data/standards/stig_google_chrome_draft.json +281 -0
- data/standards/stig_google_chrome_v23_windows.json +275 -0
- data/standards/stig_google_chrome_v24_windows.json +263 -0
- data/standards/stig_google_chrome_v24_windows_benchmark.json +227 -0
- data/standards/stig_google_search_appliance.json +209 -0
- data/standards/stig_harris_secnet_11_54.json +89 -0
- data/standards/stig_hp-ux_11.23.json +3215 -0
- data/standards/stig_hp-ux_11.31.json +3155 -0
- data/standards/stig_hp-ux_smse.json +431 -0
- data/standards/stig_hpe_3par_storeserv_3.2.x.json +131 -0
- data/standards/stig_ibm_datapower_alg.json +401 -0
- data/standards/stig_ibm_datapower_network_device_management.json +395 -0
- data/standards/stig_ibm_db2_v10.5_luw.json +575 -0
- data/standards/stig_ibm_hardware_management_console_hmc.json +221 -0
- data/standards/stig_ibm_hardware_management_console_hmc_policies.json +35 -0
- data/standards/stig_ibm_maas360_v2.3.x_mdm.json +59 -0
- data/standards/stig_ibm_zvm_using_ca_vm:secure.json +473 -0
- data/standards/stig_idps_security_requirements_guide_srg.json +1865 -0
- data/standards/stig_idsips.json +257 -0
- data/standards/stig_iis6_server.json +221 -0
- data/standards/stig_iis6_site.json +263 -0
- data/standards/stig_iis_7.0_web_server.json +155 -0
- data/standards/stig_iis_7.0_web_site.json +299 -0
- data/standards/stig_iis_8.5_server.json +293 -0
- data/standards/stig_iis_8.5_site.json +347 -0
- data/standards/stig_infoblox_7.x_dns.json +419 -0
- data/standards/stig_infrastructure_l3_switch.json +599 -0
- data/standards/stig_infrastructure_l3_switch_-_cisco.json +659 -0
- data/standards/stig_infrastructure_l3_switch_secure_technical_implementation_guide_-_cisco.json +659 -0
- data/standards/stig_infrastructure_router.json +479 -0
- data/standards/stig_infrastructure_router_-_cisco.json +539 -0
- data/standards/stig_infrastructure_router_-_juniper.json +485 -0
- data/standards/stig_infrastructure_router__cisco.json +539 -0
- data/standards/stig_infrastructure_router__juniper.json +485 -0
- data/standards/stig_internet_explorer_8.json +821 -0
- data/standards/stig_internet_explorer_9.json +815 -0
- data/standards/stig_intrusion_detection_and_prevention_systems_idps_security_requirements_guide.json +371 -0
- data/standards/stig_ipsec_vpn_gateway.json +521 -0
- data/standards/stig_java_runtime_environment_jre_6_unix.json +65 -0
- data/standards/stig_java_runtime_environment_jre_6_win7.json +65 -0
- data/standards/stig_java_runtime_environment_jre_6_windows_xp.json +77 -0
- data/standards/stig_java_runtime_environment_jre_6_winxp.json +65 -0
- data/standards/stig_java_runtime_environment_jre_7_unix.json +65 -0
- data/standards/stig_java_runtime_environment_jre_7_win7.json +65 -0
- data/standards/stig_java_runtime_environment_jre_7_winxp.json +65 -0
- data/standards/stig_java_runtime_environment_jre_version_6_unix.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_6_windows_7.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_6_windows_xp.json +65 -0
- data/standards/stig_java_runtime_environment_jre_version_7_unix.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_7_windows_7.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_7_winxp.json +77 -0
- data/standards/stig_java_runtime_environment_jre_version_8_unix.json +107 -0
- data/standards/stig_java_runtime_environment_jre_version_8_windows.json +107 -0
- data/standards/stig_jboss_eap_6.3.json +413 -0
- data/standards/stig_juniper_srx_sg_alg.json +155 -0
- data/standards/stig_juniper_srx_sg_idps.json +179 -0
- data/standards/stig_juniper_srx_sg_ndm.json +443 -0
- data/standards/stig_juniper_srx_sg_vpn.json +185 -0
- data/standards/stig_keyboard_video_and_mouse_switch.json +269 -0
- data/standards/stig_l3_kov-26_talon_wireless_role.json +77 -0
- data/standards/stig_layer_2_switch.json +347 -0
- data/standards/stig_layer_2_switch_-_cisco.json +365 -0
- data/standards/stig_lg_android_5.x_interim_security_configuration_guide.json +245 -0
- data/standards/stig_lg_android_6.x.json +281 -0
- data/standards/stig_mac_osx_10.6_workstation.json +1319 -0
- data/standards/stig_mac_osx_10.6_workstation_draft.json +1319 -0
- data/standards/stig_mainframe_product_security_requirements_guide.json +1115 -0
- data/standards/stig_mcafee_application_control_7.x.json +203 -0
- data/standards/stig_mcafee_move_2.63.6.1_multi-platform_client.json +149 -0
- data/standards/stig_mcafee_move_2.63.6.1_multi-platform_oss.json +101 -0
- data/standards/stig_mcafee_move_2.6_multi-platform_client.json +149 -0
- data/standards/stig_mcafee_move_2.6_multi-platform_oss.json +101 -0
- data/standards/stig_mcafee_move_3.6.1_multi-platform_client.json +149 -0
- data/standards/stig_mcafee_move_3.6.1_multi-platform_oss.json +101 -0
- data/standards/stig_mcafee_move_agentless_3.03.6.1_security_virtual_appliance.json +167 -0
- data/standards/stig_mcafee_move_agentless_3.0_security_virtual_appliance.json +167 -0
- data/standards/stig_mcafee_move_agentless_3.0_vsel_1.9sva.json +203 -0
- data/standards/stig_mcafee_move_agentless_3.6.1_security_virtual_appliance.json +167 -0
- data/standards/stig_mcafee_move_av_agentless_4.5.json +155 -0
- data/standards/stig_mcafee_move_av_multi-platform_4.5.json +215 -0
- data/standards/stig_mcafee_virusscan_8.8_local_client.json +533 -0
- data/standards/stig_mcafee_virusscan_8.8_managed_client.json +533 -0
- data/standards/stig_mcafee_vsel_1.92.0_local_client.json +245 -0
- data/standards/stig_mcafee_vsel_1.92.0_managed_client.json +239 -0
- data/standards/stig_mdm_server_policy.json +47 -0
- data/standards/stig_microsoft_access_2003.json +47 -0
- data/standards/stig_microsoft_access_2007.json +77 -0
- data/standards/stig_microsoft_access_2010.json +119 -0
- data/standards/stig_microsoft_access_2013.json +113 -0
- data/standards/stig_microsoft_access_2016.json +107 -0
- data/standards/stig_microsoft_dot_net_framework_4.0.json +101 -0
- data/standards/stig_microsoft_excel_2003.json +47 -0
- data/standards/stig_microsoft_excel_2007.json +155 -0
- data/standards/stig_microsoft_excel_2010.json +287 -0
- data/standards/stig_microsoft_excel_2013.json +293 -0
- data/standards/stig_microsoft_excel_2016.json +257 -0
- data/standards/stig_microsoft_exchange_2010_client_access_server_role.json +71 -0
- data/standards/stig_microsoft_exchange_2010_core_server.json +47 -0
- data/standards/stig_microsoft_exchange_2010_edge_transport_server_role.json +233 -0
- data/standards/stig_microsoft_exchange_2010_hub_transport_server_role.json +125 -0
- data/standards/stig_microsoft_exchange_2010_mailbox_server_role.json +107 -0
- data/standards/stig_microsoft_exchange_server_2003.json +647 -0
- data/standards/stig_microsoft_groove_2013.json +71 -0
- data/standards/stig_microsoft_ie_version_6.json +599 -0
- data/standards/stig_microsoft_ie_version_7.json +749 -0
- data/standards/stig_microsoft_infopath_2003.json +41 -0
- data/standards/stig_microsoft_infopath_2007.json +167 -0
- data/standards/stig_microsoft_infopath_2010.json +155 -0
- data/standards/stig_microsoft_infopath_2013.json +149 -0
- data/standards/stig_microsoft_internet_explorer_10.json +857 -0
- data/standards/stig_microsoft_internet_explorer_11.json +839 -0
- data/standards/stig_microsoft_internet_explorer_9.json +821 -0
- data/standards/stig_microsoft_lync_2013.json +29 -0
- data/standards/stig_microsoft_office_system_2007.json +221 -0
- data/standards/stig_microsoft_office_system_2010.json +233 -0
- data/standards/stig_microsoft_office_system_2013.json +293 -0
- data/standards/stig_microsoft_office_system_2016.json +131 -0
- data/standards/stig_microsoft_onedrivebusiness_2016.json +89 -0
- data/standards/stig_microsoft_onenote_2010.json +77 -0
- data/standards/stig_microsoft_onenote_2013.json +71 -0
- data/standards/stig_microsoft_onenote_2016.json +71 -0
- data/standards/stig_microsoft_outlook_2003.json +65 -0
- data/standards/stig_microsoft_outlook_2007.json +479 -0
- data/standards/stig_microsoft_outlook_2010.json +515 -0
- data/standards/stig_microsoft_outlook_2013.json +497 -0
- data/standards/stig_microsoft_outlook_2016.json +359 -0
- data/standards/stig_microsoft_powerpoint_2003.json +47 -0
- data/standards/stig_microsoft_powerpoint_2007.json +131 -0
- data/standards/stig_microsoft_powerpoint_2010.json +191 -0
- data/standards/stig_microsoft_powerpoint_2013.json +251 -0
- data/standards/stig_microsoft_powerpoint_2016.json +233 -0
- data/standards/stig_microsoft_project_2010.json +83 -0
- data/standards/stig_microsoft_project_2013.json +95 -0
- data/standards/stig_microsoft_project_2016.json +95 -0
- data/standards/stig_microsoft_publisher_2010.json +107 -0
- data/standards/stig_microsoft_publisher_2013.json +101 -0
- data/standards/stig_microsoft_publisher_2016.json +101 -0
- data/standards/stig_microsoft_sharepoint_designer_2013.json +71 -0
- data/standards/stig_microsoft_skypebusiness_2016.json +29 -0
- data/standards/stig_microsoft_sql_server_2005_database.json +167 -0
- data/standards/stig_microsoft_sql_server_2005_instance.json +1001 -0
- data/standards/stig_microsoft_sql_server_2012_database.json +179 -0
- data/standards/stig_microsoft_sql_server_2012_database_instance.json +929 -0
- data/standards/stig_microsoft_visio_2013.json +89 -0
- data/standards/stig_microsoft_visio_2016.json +89 -0
- data/standards/stig_microsoft_windows_10_mobile.json +215 -0
- data/standards/stig_microsoft_windows_2008_server_domain_name_system.json +269 -0
- data/standards/stig_microsoft_windows_2012_server_domain_name_system.json +551 -0
- data/standards/stig_microsoft_windows_phone_8.1.json +161 -0
- data/standards/stig_microsoft_windows_server_2012_domain_controller.json +2633 -0
- data/standards/stig_microsoft_windows_server_2012_member_server.json +2411 -0
- data/standards/stig_microsoft_word_2003.json +47 -0
- data/standards/stig_microsoft_word_2007.json +119 -0
- data/standards/stig_microsoft_word_2010.json +221 -0
- data/standards/stig_microsoft_word_2013.json +221 -0
- data/standards/stig_microsoft_word_2016.json +215 -0
- data/standards/stig_mobile_application_management_mam_server.json +95 -0
- data/standards/stig_mobile_application_security_requirements_guide.json +233 -0
- data/standards/stig_mobile_device_integrity_scanning_mdis_server.json +119 -0
- data/standards/stig_mobile_device_management_mdm_server.json +125 -0
- data/standards/stig_mobile_device_manager_security_requirements_guide.json +2555 -0
- data/standards/stig_mobile_email_management_mem_server.json +197 -0
- data/standards/stig_mobile_operating_system_security_requirements_guide.json +1943 -0
- data/standards/stig_mobile_policy.json +35 -0
- data/standards/stig_mobile_policy_security_requirements_guide.json +437 -0
- data/standards/stig_mobileiron_core_v9.x_mdm.json +89 -0
- data/standards/stig_mobility_policy.json +65 -0
- data/standards/stig_mozilla_firefox.json +161 -0
- data/standards/stig_ms_exchange_2013_client_access_server.json +209 -0
- data/standards/stig_ms_exchange_2013_edge_transport_server.json +443 -0
- data/standards/stig_ms_exchange_2013_mailbox_server.json +437 -0
- data/standards/stig_ms_sharepoint_2010.json +269 -0
- data/standards/stig_ms_sharepoint_2013.json +245 -0
- data/standards/stig_ms_sharepoint_designer_2013.json +71 -0
- data/standards/stig_ms_sql_server_2014_database.json +263 -0
- data/standards/stig_ms_sql_server_2014_instance.json +575 -0
- data/standards/stig_ms_sql_server_2016_database.json +185 -0
- data/standards/stig_ms_sql_server_2016_instance.json +731 -0
- data/standards/stig_ms_windows_defender_antivirus.json +257 -0
- data/standards/stig_multifunction_device_and_network_printers.json +131 -0
- data/standards/stig_network_device_management_security_requirements_guide.json +863 -0
- data/standards/stig_network_devices.json +389 -0
- data/standards/stig_network_infrastructure_policy.json +455 -0
- data/standards/stig_network_security_requirements_guide.json +1961 -0
- data/standards/stig_operating_system_security_requirements_guide.json +1961 -0
- data/standards/stig_oracle_10_database_installation.json +527 -0
- data/standards/stig_oracle_10_database_instance.json +569 -0
- data/standards/stig_oracle_11_database_installation.json +527 -0
- data/standards/stig_oracle_11_database_instance.json +551 -0
- data/standards/stig_oracle_database_10g_installation.json +527 -0
- data/standards/stig_oracle_database_10g_instance.json +581 -0
- data/standards/stig_oracle_database_11.2g.json +1229 -0
- data/standards/stig_oracle_database_11g_installation.json +527 -0
- data/standards/stig_oracle_database_11g_instance.json +575 -0
- data/standards/stig_oracle_database_12c.json +1217 -0
- data/standards/stig_oracle_http_server_12.1.3.json +1703 -0
- data/standards/stig_oracle_linux_5.json +3431 -0
- data/standards/stig_oracle_linux_6.json +1583 -0
- data/standards/stig_oracle_weblogic_server_12c.json +443 -0
- data/standards/stig_palo_alto_networks_alg.json +311 -0
- data/standards/stig_palo_alto_networks_idps.json +185 -0
- data/standards/stig_palo_alto_networks_ndm.json +251 -0
- data/standards/stig_pda.json +83 -0
- data/standards/stig_pdasmartphone.json +95 -0
- data/standards/stig_perimeter_l3_switch.json +923 -0
- data/standards/stig_perimeter_l3_switch_-_cisco.json +1001 -0
- data/standards/stig_perimeter_router.json +803 -0
- data/standards/stig_perimeter_router_cisco.json +881 -0
- data/standards/stig_perimeter_router_juniper.json +803 -0
- data/standards/stig_postgresql_9.x.json +677 -0
- data/standards/stig_red_hat_enterprise_linux_5.json +3437 -0
- data/standards/stig_red_hat_enterprise_linux_6.json +1565 -0
- data/standards/stig_red_hat_enterprise_linux_7.json +1451 -0
- data/standards/stig_remote_access_policy.json +317 -0
- data/standards/stig_removable_storage_and_external_connection_technologies.json +143 -0
- data/standards/stig_removable_storage_and_external_connections.json +137 -0
- data/standards/stig_rfid_scanner.json +35 -0
- data/standards/stig_rfid_workstation.json +23 -0
- data/standards/stig_riverbed_steelhead_cx_v8_alg.json +83 -0
- data/standards/stig_riverbed_steelhead_cx_v8_ndm.json +371 -0
- data/standards/stig_router_security_requirements_guide.json +575 -0
- data/standards/stig_samsung_android_os_5_with_knox_2.0.json +365 -0
- data/standards/stig_samsung_android_os_6_with_knox_2.x.json +377 -0
- data/standards/stig_samsung_android_os_7_with_knox_2.x.json +443 -0
- data/standards/stig_samsung_android_with_knox_1.x.json +293 -0
- data/standards/stig_samsung_android_with_knox_2.x.json +371 -0
- data/standards/stig_samsung_knox_android_1.0.json +167 -0
- data/standards/stig_sharepoint_2010.json +269 -0
- data/standards/stig_sharepoint_2013.json +245 -0
- data/standards/stig_smartphone_policy.json +131 -0
- data/standards/stig_solaris_10_sparc.json +3029 -0
- data/standards/stig_solaris_10_x86.json +3065 -0
- data/standards/stig_solaris_11_sparc.json +1427 -0
- data/standards/stig_solaris_11_x86.json +1421 -0
- data/standards/stig_solaris_9_sparc.json +2915 -0
- data/standards/stig_solaris_9_x86.json +2915 -0
- data/standards/stig_sun_ray_4.json +185 -0
- data/standards/stig_sun_ray_4_policy.json +77 -0
- data/standards/stig_suse_linux_enterprise_server_v11system_z.json +3311 -0
- data/standards/stig_symantec_endpoint_protection_12.1_local_client_antivirus.json +689 -0
- data/standards/stig_symantec_endpoint_protection_12.1_managed_client_antivirus.json +695 -0
- data/standards/stig_tanium_6.5.json +461 -0
- data/standards/stig_tanium_7.0.json +803 -0
- data/standards/stig_test_and_development_zone_a.json +167 -0
- data/standards/stig_test_and_development_zone_b.json +179 -0
- data/standards/stig_test_and_development_zone_c.json +143 -0
- data/standards/stig_test_and_development_zone_d.json +143 -0
- data/standards/stig_traditional_security.json +917 -0
- data/standards/stig_unix_srg.json +3287 -0
- data/standards/stig_video_services_policy.json +497 -0
- data/standards/stig_video_teleconference.json +47 -0
- data/standards/stig_video_teleconference_vtc.json +12 -0
- data/standards/stig_vmware_esx_3_policy.json +155 -0
- data/standards/stig_vmware_esx_3_server.json +3791 -0
- data/standards/stig_vmware_esx_3_virtual_center.json +257 -0
- data/standards/stig_vmware_esx_3_virtual_machine.json +53 -0
- data/standards/stig_vmware_esxi_server_5.0.json +809 -0
- data/standards/stig_vmware_esxi_v5.json +5177 -0
- data/standards/stig_vmware_esxi_version_5_virtual_machine.json +317 -0
- data/standards/stig_vmware_nsx_distributed_firewall.json +83 -0
- data/standards/stig_vmware_nsx_distributed_logical_router.json +35 -0
- data/standards/stig_vmware_nsx_manager.json +191 -0
- data/standards/stig_vmware_vcenter_server.json +179 -0
- data/standards/stig_vmware_vcenter_server_version_5.json +149 -0
- data/standards/stig_vmware_vsphere_esxi_6.0.json +659 -0
- data/standards/stig_vmware_vsphere_vcenter_server_version_6.json +311 -0
- data/standards/stig_vmware_vsphere_virtual_machine_version_6.json +269 -0
- data/standards/stig_voice_and_video_over_internet_protocol_vvoip_policy.json +407 -0
- data/standards/stig_voice_video_endpoint_security_requirements_guide.json +395 -0
- data/standards/stig_voice_video_services_policy.json +671 -0
- data/standards/stig_voice_video_session_management_security_requirements_guide.json +329 -0
- data/standards/stig_voicevideo_over_internet_protocol.json +419 -0
- data/standards/stig_voicevideo_over_internet_protocol_vvoip.json +263 -0
- data/standards/stig_voicevideo_services_policy.json +569 -0
- data/standards/stig_web_policy.json +95 -0
- data/standards/stig_web_server.json +317 -0
- data/standards/stig_web_server_security_requirements_guide.json +587 -0
- data/standards/stig_win2k3_audit.json +761 -0
- data/standards/stig_win2k8_audit.json +1085 -0
- data/standards/stig_win2k8_r2_audit.json +1637 -0
- data/standards/stig_win7_audit.json +1613 -0
- data/standards/stig_windows_10.json +1691 -0
- data/standards/stig_windows_2003_domain_controller.json +893 -0
- data/standards/stig_windows_2003_member_server.json +845 -0
- data/standards/stig_windows_2008_domain_controller.json +1475 -0
- data/standards/stig_windows_2008_member_server.json +1301 -0
- data/standards/stig_windows_7.json +1781 -0
- data/standards/stig_windows_8.json +2399 -0
- data/standards/stig_windows_88.1.json +2273 -0
- data/standards/stig_windows_8_8.1.json +2297 -0
- data/standards/stig_windows_defender_antivirus.json +239 -0
- data/standards/stig_windows_dns.json +185 -0
- data/standards/stig_windows_firewall_with_advanced_security.json +137 -0
- data/standards/stig_windows_paw.json +155 -0
- data/standards/stig_windows_phone_6.5_with_good_mobility_suite.json +65 -0
- data/standards/stig_windows_server_2008_r2_domain_controller.json +1961 -0
- data/standards/stig_windows_server_2008_r2_member_server.json +1745 -0
- data/standards/stig_windows_server_20122012_r2_domain_controller.json +2255 -0
- data/standards/stig_windows_server_20122012_r2_member_server.json +2045 -0
- data/standards/stig_windows_server_2012_2012_r2_domain_controller.json +2279 -0
- data/standards/stig_windows_server_2012_2012_r2_member_server.json +2075 -0
- data/standards/stig_windows_server_2012_domain_controller.json +2471 -0
- data/standards/stig_windows_server_2012_member_server.json +2249 -0
- data/standards/stig_windows_server_2016.json +1661 -0
- data/standards/stig_windows_vista.json +1517 -0
- data/standards/stig_windows_xp.json +893 -0
- data/standards/stig_wireless_keyboard_and_mouse.json +23 -0
- data/standards/stig_wireless_management_server_policy.json +53 -0
- data/standards/stig_wireless_remote_access_policy_security_implementation_guide.json +29 -0
- data/standards/stig_wlan_access_point_enclave-niprnet_connected.json +227 -0
- data/standards/stig_wlan_access_point_internet_gateway_only_connection.json +209 -0
- data/standards/stig_wlan_access_point_policy.json +17 -0
- data/standards/stig_wlan_authentication_server.json +29 -0
- data/standards/stig_wlan_bridge.json +209 -0
- data/standards/stig_wlan_client.json +65 -0
- data/standards/stig_wlan_controller.json +215 -0
- data/standards/stig_wlan_ids_sensorserver.json +23 -0
- data/standards/stig_wman_access_point.json +263 -0
- data/standards/stig_wman_bridge.json +209 -0
- data/standards/stig_wman_subscriber.json +65 -0
- data/standards/stig_zos_acf2.json +1451 -0
- data/standards/stig_zos_bmc_control-dacf2.json +53 -0
- data/standards/stig_zos_bmc_control-dracf.json +59 -0
- data/standards/stig_zos_bmc_control-dtss.json +65 -0
- data/standards/stig_zos_bmc_control-macf2.json +59 -0
- data/standards/stig_zos_bmc_control-mracf.json +65 -0
- data/standards/stig_zos_bmc_control-mrestartacf2.json +23 -0
- data/standards/stig_zos_bmc_control-mrestartracf.json +23 -0
- data/standards/stig_zos_bmc_control-mrestarttss.json +23 -0
- data/standards/stig_zos_bmc_control-mtss.json +71 -0
- data/standards/stig_zos_bmc_control-oacf2.json +53 -0
- data/standards/stig_zos_bmc_control-oracf.json +59 -0
- data/standards/stig_zos_bmc_control-otss.json +65 -0
- data/standards/stig_zos_bmc_ioaacf2.json +53 -0
- data/standards/stig_zos_bmc_ioaracf.json +59 -0
- data/standards/stig_zos_bmc_ioatss.json +65 -0
- data/standards/stig_zos_bmc_mainviewzosacf2.json +47 -0
- data/standards/stig_zos_bmc_mainviewzosracf.json +53 -0
- data/standards/stig_zos_bmc_mainviewzostss.json +59 -0
- data/standards/stig_zos_ca_1_tape_managementacf2.json +65 -0
- data/standards/stig_zos_ca_1_tape_managementracf.json +77 -0
- data/standards/stig_zos_ca_1_tape_managementtss.json +77 -0
- data/standards/stig_zos_ca_auditoracf2.json +29 -0
- data/standards/stig_zos_ca_auditorracf.json +29 -0
- data/standards/stig_zos_ca_auditortss.json +29 -0
- data/standards/stig_zos_ca_common_servicesacf2.json +23 -0
- data/standards/stig_zos_ca_common_servicesracf.json +29 -0
- data/standards/stig_zos_ca_common_servicestss.json +29 -0
- data/standards/stig_zos_ca_micsacf2.json +23 -0
- data/standards/stig_zos_ca_micsracf.json +23 -0
- data/standards/stig_zos_ca_micstss.json +23 -0
- data/standards/stig_zos_ca_mimacf2.json +41 -0
- data/standards/stig_zos_ca_mimracf.json +47 -0
- data/standards/stig_zos_ca_mimtss.json +47 -0
- data/standards/stig_zos_ca_vtapeacf2.json +29 -0
- data/standards/stig_zos_ca_vtaperacf.json +35 -0
- data/standards/stig_zos_ca_vtapetss.json +35 -0
- data/standards/stig_zos_catalog_solutionsacf2.json +23 -0
- data/standards/stig_zos_catalog_solutionsracf.json +23 -0
- data/standards/stig_zos_catalog_solutionstss.json +23 -0
- data/standards/stig_zos_clsupersessionacf2.json +53 -0
- data/standards/stig_zos_clsupersessionracf.json +65 -0
- data/standards/stig_zos_clsupersessiontss.json +71 -0
- data/standards/stig_zos_compuware_abend-aidacf2.json +47 -0
- data/standards/stig_zos_compuware_abend-aidracf.json +53 -0
- data/standards/stig_zos_compuware_abend-aidtss.json +53 -0
- data/standards/stig_zos_cssmtpacf2.json +23 -0
- data/standards/stig_zos_cssmtpracf.json +29 -0
- data/standards/stig_zos_cssmtptss.json +29 -0
- data/standards/stig_zos_fdracf2.json +23 -0
- data/standards/stig_zos_fdrracf.json +23 -0
- data/standards/stig_zos_fdrtss.json +23 -0
- data/standards/stig_zos_hcdacf2.json +29 -0
- data/standards/stig_zos_hcdracf.json +29 -0
- data/standards/stig_zos_hcdtss.json +29 -0
- data/standards/stig_zos_ibm_cics_transaction_serveracf2.json +17 -0
- data/standards/stig_zos_ibm_cics_transaction_serverracf.json +17 -0
- data/standards/stig_zos_ibm_cics_transaction_servertss.json +17 -0
- data/standards/stig_zos_ibm_health_checkeracf2.json +23 -0
- data/standards/stig_zos_ibm_health_checkerracf.json +29 -0
- data/standards/stig_zos_ibm_health_checkertss.json +29 -0
- data/standards/stig_zos_ibm_system_display_and_search_facility_sdsfacf2.json +53 -0
- data/standards/stig_zos_ibm_system_display_and_search_facility_sdsfracf.json +59 -0
- data/standards/stig_zos_ibm_system_display_and_search_facility_sdsftss.json +53 -0
- data/standards/stig_zos_icsfacf2.json +29 -0
- data/standards/stig_zos_icsfracf.json +35 -0
- data/standards/stig_zos_icsftss.json +35 -0
- data/standards/stig_zos_netviewacf2.json +41 -0
- data/standards/stig_zos_netviewracf.json +47 -0
- data/standards/stig_zos_netviewtss.json +53 -0
- data/standards/stig_zos_quest_nc-passacf2.json +35 -0
- data/standards/stig_zos_quest_nc-passracf.json +41 -0
- data/standards/stig_zos_quest_nc-passtss.json +47 -0
- data/standards/stig_zos_racf.json +1415 -0
- data/standards/stig_zos_roscoeacf2.json +47 -0
- data/standards/stig_zos_roscoeracf.json +53 -0
- data/standards/stig_zos_roscoetss.json +59 -0
- data/standards/stig_zos_srrauditacf2.json +23 -0
- data/standards/stig_zos_srrauditracf.json +23 -0
- data/standards/stig_zos_srraudittss.json +23 -0
- data/standards/stig_zos_tadzacf2.json +29 -0
- data/standards/stig_zos_tadzracf.json +35 -0
- data/standards/stig_zos_tadztss.json +35 -0
- data/standards/stig_zos_tdmfacf2.json +23 -0
- data/standards/stig_zos_tdmfracf.json +23 -0
- data/standards/stig_zos_tdmftss.json +23 -0
- data/standards/stig_zos_tss.json +1523 -0
- data/standards/stig_zos_vssracf.json +29 -0
- metadata +691 -0
|
@@ -0,0 +1,47 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "stig_zos_netviewracf",
|
|
3
|
+
"date": "2016-06-30",
|
|
4
|
+
"description": "None",
|
|
5
|
+
"title": "z/OS NetView for RACF STIG",
|
|
6
|
+
"version": "None",
|
|
7
|
+
"item_syntax": "^\\w-\\d+$",
|
|
8
|
+
"section_separator": null,
|
|
9
|
+
"items": [
|
|
10
|
+
{
|
|
11
|
+
"id": "V-16932",
|
|
12
|
+
"title": "NetView install data sets are not properly protected.",
|
|
13
|
+
"description": "NetView Install data sets provide the capability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to their data sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.",
|
|
14
|
+
"severity": "medium"
|
|
15
|
+
},
|
|
16
|
+
{
|
|
17
|
+
"id": "V-17067",
|
|
18
|
+
"title": "NetView STC data sets are not properly protected.",
|
|
19
|
+
"description": "NetView STC data sets provide the capability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to their data sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.",
|
|
20
|
+
"severity": "medium"
|
|
21
|
+
},
|
|
22
|
+
{
|
|
23
|
+
"id": "V-17452",
|
|
24
|
+
"title": "NetView Started Task name(s) is not properly identified / defined to the system ACP.\n",
|
|
25
|
+
"description": "NetView requires a started task(s) that will be restricted to certain resources, datasets and other system functions. By defining the started task as a userid to the system ACP, It allows the ACP to control the access and authorized users that require these capabilities. Failure to properly control these capabilities, could compromise of the operating system environment, ACP, and customer data.",
|
|
26
|
+
"severity": "medium"
|
|
27
|
+
},
|
|
28
|
+
{
|
|
29
|
+
"id": "V-17454",
|
|
30
|
+
"title": "IBM Tivoli NetView Started task(s) must be properly defined to the STARTED resource class for RACF.",
|
|
31
|
+
"description": "Access to product resources should be restricted to only those individuals responsible for the application connectivity and who have a requirement to access these resources. Improper control of product resources could potentially compromise the operating system, ACP, and customer data.",
|
|
32
|
+
"severity": "medium"
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"id": "V-17947",
|
|
36
|
+
"title": "NetView resources must be properly defined and protected.",
|
|
37
|
+
"description": "NetView can run with sensitive system privileges, and potentially can circumvent system controls. Failure to properly control access to product resources could result in the compromise of the operating system environment, and compromise the confidentiality of customer data. Many utilities assign resource controls that can be granted to system programmers only in greater than read authority. Resources are also granted to certain non systems personnel with read only authority.",
|
|
38
|
+
"severity": "medium"
|
|
39
|
+
},
|
|
40
|
+
{
|
|
41
|
+
"id": "V-18014",
|
|
42
|
+
"title": "NetView configuration/parameter values must be specified properly.",
|
|
43
|
+
"description": "NetView configuration/parameters control the security and operational characteristics of products. If these parameter values are improperly specified, security and operational controls may be weakened. This exposure may threaten the availability of the product applications, and compromise the confidentiality of customer data.",
|
|
44
|
+
"severity": "medium"
|
|
45
|
+
}
|
|
46
|
+
]
|
|
47
|
+
}
|
|
@@ -0,0 +1,53 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "stig_zos_netviewtss",
|
|
3
|
+
"date": "2016-06-30",
|
|
4
|
+
"description": "None",
|
|
5
|
+
"title": "z/OS NetView for TSS STIG",
|
|
6
|
+
"version": "None",
|
|
7
|
+
"item_syntax": "^\\w-\\d+$",
|
|
8
|
+
"section_separator": null,
|
|
9
|
+
"items": [
|
|
10
|
+
{
|
|
11
|
+
"id": "V-16932",
|
|
12
|
+
"title": "NetView install data sets are not properly protected.",
|
|
13
|
+
"description": "NetView install data sets provide the capability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to these data sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.",
|
|
14
|
+
"severity": "medium"
|
|
15
|
+
},
|
|
16
|
+
{
|
|
17
|
+
"id": "V-17067",
|
|
18
|
+
"title": "NetView STC data sets are not properly protected.",
|
|
19
|
+
"description": "NetView STC data sets provide the capability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to their data sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.",
|
|
20
|
+
"severity": "medium"
|
|
21
|
+
},
|
|
22
|
+
{
|
|
23
|
+
"id": "V-17452",
|
|
24
|
+
"title": "NetView Started Task name(s) is not properly identified / defined to the system ACP.",
|
|
25
|
+
"description": "NetView requires a started task(s) that will be restricted to certain resources, datasets and other system functions. By defining the started task as a userid to the system ACP, It allows the ACP to control the access and authorized users that require these capabilities. Failure to properly control these capabilities, could compromise of the operating system environment, ACP, and customer data.",
|
|
26
|
+
"severity": "medium"
|
|
27
|
+
},
|
|
28
|
+
{
|
|
29
|
+
"id": "V-17454",
|
|
30
|
+
"title": "IBM Tivoli NetView Started task(s) must be properly defined to the Started Task Table ACID for Top Secret.",
|
|
31
|
+
"description": "Access to product resources should be restricted to only those individuals responsible for the application connectivity and who have a requirement to access these resources. Improper control of product resources could potentially compromise the operating system, ACP, and customer data.",
|
|
32
|
+
"severity": "medium"
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"id": "V-17469",
|
|
36
|
+
"title": "NetView is not properly defined to the Facility Matrix Table for Top Secret.",
|
|
37
|
+
"description": "Improperly defined security controls for the Product could result in the compromise of the network, operating system, and customer data.",
|
|
38
|
+
"severity": "medium"
|
|
39
|
+
},
|
|
40
|
+
{
|
|
41
|
+
"id": "V-17947",
|
|
42
|
+
"title": "NetView resources must be properly defined and protected.",
|
|
43
|
+
"description": "NetView can run with sensitive system privileges, and potentially can circumvent system controls. Failure to properly control access to product resources could result in the compromise of the operating system environment, and compromise the confidentiality of customer data. Many utilities assign resource controls that can be granted to system programmers only in greater than read authority. Resources are also granted to certain non systems personnel with read only authority.",
|
|
44
|
+
"severity": "medium"
|
|
45
|
+
},
|
|
46
|
+
{
|
|
47
|
+
"id": "V-18014",
|
|
48
|
+
"title": "NetView configuration/parameter values must be specified properly.",
|
|
49
|
+
"description": "NetView configuration/parameters control the security and operational characteristics of products. If these parameter values are improperly specified, security and operational controls may be weakened. This exposure may threaten the availability of the product applications, and compromise the confidentiality of customer data.",
|
|
50
|
+
"severity": "medium"
|
|
51
|
+
}
|
|
52
|
+
]
|
|
53
|
+
}
|
|
@@ -0,0 +1,35 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "stig_zos_quest_nc-passacf2",
|
|
3
|
+
"date": "2015-01-15",
|
|
4
|
+
"description": "None",
|
|
5
|
+
"title": "z/OS Quest NC-Pass for ACF2 STIG",
|
|
6
|
+
"version": "None",
|
|
7
|
+
"item_syntax": "^\\w-\\d+$",
|
|
8
|
+
"section_separator": null,
|
|
9
|
+
"items": [
|
|
10
|
+
{
|
|
11
|
+
"id": "V-16932",
|
|
12
|
+
"title": "Quest NC-Pass installation data sets will be properly protected.",
|
|
13
|
+
"description": "Quest NC-Pass installation data sets have the ability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to these data sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.",
|
|
14
|
+
"severity": "medium"
|
|
15
|
+
},
|
|
16
|
+
{
|
|
17
|
+
"id": "V-17067",
|
|
18
|
+
"title": "Quest NC-Pass STC data sets will be properly protected.",
|
|
19
|
+
"description": "Quest NC-Pass STC data sets have the ability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to these data sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.",
|
|
20
|
+
"severity": "medium"
|
|
21
|
+
},
|
|
22
|
+
{
|
|
23
|
+
"id": "V-17452",
|
|
24
|
+
"title": "Quest NC-Pass Started Task name will be properly identified and/or defined to the system ACP.",
|
|
25
|
+
"description": "Quest NC-Pass requires a started task that will be restricted to certain resources, datasets and other system functions. By defining the started task as a userid to the system ACP, It allows the ACP to control the access and authorized users that require these capabilities. Failure to properly control these capabilities, could compromise of the operating system environment, ACP, and customer data.",
|
|
26
|
+
"severity": "medium"
|
|
27
|
+
},
|
|
28
|
+
{
|
|
29
|
+
"id": "V-17947",
|
|
30
|
+
"title": "Quest NC-Pass will be used by Highly-Sensitive users.",
|
|
31
|
+
"description": "DISA has directed that Quest NC-Pass extended authentication be implemented on all domains. All users with update and alter access to sensitive system-level data sets and resources, or who possess special security privileges, are required to use NC-Pass for extended authentication. Typical personnel required to use NC-Pass include, but are not limited to, systems programming, security, operations, network/communications, storage management, and production control.\n\nImproper enforcement of extended authentication through NC-Pass could potentially compromise the operating system, ACP, and customer data.",
|
|
32
|
+
"severity": "medium"
|
|
33
|
+
}
|
|
34
|
+
]
|
|
35
|
+
}
|
|
@@ -0,0 +1,41 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "stig_zos_quest_nc-passracf",
|
|
3
|
+
"date": "2015-01-15",
|
|
4
|
+
"description": "None",
|
|
5
|
+
"title": "z/OS Quest NC-Pass for RACF STIG",
|
|
6
|
+
"version": "None",
|
|
7
|
+
"item_syntax": "^\\w-\\d+$",
|
|
8
|
+
"section_separator": null,
|
|
9
|
+
"items": [
|
|
10
|
+
{
|
|
11
|
+
"id": "V-16932",
|
|
12
|
+
"title": "Quest NC-Pass installation data sets will be properly protected.",
|
|
13
|
+
"description": "Quest NC-Pass installation data sets have the ability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to these data sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.",
|
|
14
|
+
"severity": "medium"
|
|
15
|
+
},
|
|
16
|
+
{
|
|
17
|
+
"id": "V-17067",
|
|
18
|
+
"title": "Quest NC-Pass STC data sets will be properly protected.",
|
|
19
|
+
"description": "Quest NC-Pass STC data sets have the ability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to these data sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.",
|
|
20
|
+
"severity": "medium"
|
|
21
|
+
},
|
|
22
|
+
{
|
|
23
|
+
"id": "V-17452",
|
|
24
|
+
"title": "Quest NC-Pass Started Task name will be properly identified and/or defined to the system ACP.",
|
|
25
|
+
"description": "Quest NC-Pass requires a started task that will be restricted to certain resources, datasets and other system functions. By defining the started task as a userid to the system ACP, It allows the ACP to control the access and authorized users that require these capabilities. Failure to properly control these capabilities, could compromise of the operating system environment, ACP, and customer data.",
|
|
26
|
+
"severity": "medium"
|
|
27
|
+
},
|
|
28
|
+
{
|
|
29
|
+
"id": "V-17454",
|
|
30
|
+
"title": "Quest NC-Pass Started task will be properly defined to the STARTED resource class for RACF.",
|
|
31
|
+
"description": "Access to product resources should be restricted to only those individuals responsible for the application connectivity and who have a requirement to access these resources. Improper control of product resources could potentially compromise the operating system, ACP, and customer data.",
|
|
32
|
+
"severity": "medium"
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"id": "V-17947",
|
|
36
|
+
"title": "Quest NC-Pass will be used by Highly-Sensitive users.",
|
|
37
|
+
"description": "DISA has directed that Quest NC-Pass extended authentication be implemented on all domains. All users with update and alter access to sensitive system-level data sets and resources, or who possess special security privileges, are required to use NC-Pass for extended authentication. Typical personnel required to use NC-Pass include, but are not limited to, systems programming, security, operations, network/communications, storage management, and production control.\n\nImproper enforcement of extended authentication through NC-Pass could potentially compromise the operating system, ACP, and customer data.",
|
|
38
|
+
"severity": "medium"
|
|
39
|
+
}
|
|
40
|
+
]
|
|
41
|
+
}
|
|
@@ -0,0 +1,47 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "stig_zos_quest_nc-passtss",
|
|
3
|
+
"date": "2015-01-15",
|
|
4
|
+
"description": "None",
|
|
5
|
+
"title": "z/OS Quest NC-Pass for TSS STIG",
|
|
6
|
+
"version": "None",
|
|
7
|
+
"item_syntax": "^\\w-\\d+$",
|
|
8
|
+
"section_separator": null,
|
|
9
|
+
"items": [
|
|
10
|
+
{
|
|
11
|
+
"id": "V-16932",
|
|
12
|
+
"title": "Quest NC-Pass installation data sets will be properly protected.",
|
|
13
|
+
"description": "Quest NC-Pass installation data sets have the ability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to these data sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.",
|
|
14
|
+
"severity": "medium"
|
|
15
|
+
},
|
|
16
|
+
{
|
|
17
|
+
"id": "V-17067",
|
|
18
|
+
"title": "Quest NC-Pass STC data sets will be properly protected.",
|
|
19
|
+
"description": "Quest NC-Pass STC data sets have the ability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to these data sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.",
|
|
20
|
+
"severity": "medium"
|
|
21
|
+
},
|
|
22
|
+
{
|
|
23
|
+
"id": "V-17452",
|
|
24
|
+
"title": "Quest NC-Pass Started Task name will be properly identified and/or defined to the system ACP.",
|
|
25
|
+
"description": "Quest NC-Pass requires a started task that will be restricted to certain resources, datasets and other system functions. By defining the started task as a userid to the system ACP, It allows the ACP to control the access and authorized users that require these capabilities. Failure to properly control these capabilities, could compromise of the operating system environment, ACP, and customer data.",
|
|
26
|
+
"severity": "medium"
|
|
27
|
+
},
|
|
28
|
+
{
|
|
29
|
+
"id": "V-17454",
|
|
30
|
+
"title": "Quest NC-Pass Started task will be properly defined to the Started Task Table ACID for Top Secret.",
|
|
31
|
+
"description": "Access to product resources should be restricted to only those individuals responsible for the application connectivity and who have a requirement to access these resources. Improper control of product resources could potentially compromise the operating system, ACP, and customer data.",
|
|
32
|
+
"severity": "medium"
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"id": "V-17469",
|
|
36
|
+
"title": "Quest NC-Pass will be properly defined to the Facility Matrix Table. ",
|
|
37
|
+
"description": "Improperly defined security controls for Quest NC-Pass could result in the compromise of the network, operating system, and customer data.",
|
|
38
|
+
"severity": "medium"
|
|
39
|
+
},
|
|
40
|
+
{
|
|
41
|
+
"id": "V-17947",
|
|
42
|
+
"title": "Quest NC-Pass will be used by Highly-Sensitive users.",
|
|
43
|
+
"description": "DISA has directed that Quest NC-Pass extended authentication be implemented on all domains. All users with update and alter access to sensitive system-level data sets and resources, or who possess special security privileges, are required to use NC-Pass for extended authentication. Typical personnel required to use NC-Pass include, but are not limited to, systems programming, security, operations, network/communications, storage management, and production control.\n\nImproper enforcement of extended authentication through NC-Pass could potentially compromise the operating system, ACP, and customer data.",
|
|
44
|
+
"severity": "medium"
|
|
45
|
+
}
|
|
46
|
+
]
|
|
47
|
+
}
|
|
@@ -0,0 +1,1415 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "stig_zos_racf",
|
|
3
|
+
"date": "2018-04-04",
|
|
4
|
+
"description": "None",
|
|
5
|
+
"title": "z/OS RACF STIG",
|
|
6
|
+
"version": "None",
|
|
7
|
+
"item_syntax": "^\\w-\\d+$",
|
|
8
|
+
"section_separator": null,
|
|
9
|
+
"items": [
|
|
10
|
+
{
|
|
11
|
+
"id": "V-100",
|
|
12
|
+
"title": "Non-existent or inaccessible LINKLIST libraries.",
|
|
13
|
+
"description": "LINKLIST libraries give a common access point for the general usage of modules. Many of the subsystems installed on a domain rely upon these modules for proper execution. If the list of libraries found in this LINKLIST is not properly maintained, the integrity of the operating environment is subject to compromise.",
|
|
14
|
+
"severity": "low"
|
|
15
|
+
},
|
|
16
|
+
{
|
|
17
|
+
"id": "V-101",
|
|
18
|
+
"title": "Non-standard SMF data collection options specified.",
|
|
19
|
+
"description": "SMF data collection is the basic unit of tracking of all system functions and actions. Included in this tracking data are the audit trails from each of the ACPs. If the control options for the recording of this tracking are not properly maintained, then accountability cannot be monitored, and its use in the execution of a contingency plan could be compromised.",
|
|
20
|
+
"severity": "medium"
|
|
21
|
+
},
|
|
22
|
+
{
|
|
23
|
+
"id": "V-102",
|
|
24
|
+
"title": "Required SMF data record types must be collected.",
|
|
25
|
+
"description": "SMF data collection is the basic unit of tracking of all system functions and actions. Included in this tracking data are the audit records from each of the ACPs and system. If the required SMF data record types are not being collected, then accountability cannot be monitored, and its use in the execution of a contingency plan could be compromised.",
|
|
26
|
+
"severity": "medium"
|
|
27
|
+
},
|
|
28
|
+
{
|
|
29
|
+
"id": "V-103",
|
|
30
|
+
"title": "An automated process is not in place to collect and retain SMF data.",
|
|
31
|
+
"description": "SMF data collection is the basic unit of tracking of all system functions and actions. Included in this racking data is the audit trail from the ACP. If the control options for the recording of this tracking are not properly maintained, then accountability cannot be monitored and its use in the execution of a contingency plan could be compromised. Failure to collect SMF data in a timely fashion can result in the loss of critical system data.",
|
|
32
|
+
"severity": "medium"
|
|
33
|
+
},
|
|
34
|
+
{
|
|
35
|
+
"id": "V-104",
|
|
36
|
+
"title": "ACP database is not on a separate physical volume from its backup and recovery datasets. ",
|
|
37
|
+
"description": "The ACP backup and recovery data files provide the only means of recovering the ACP database in the event of its damage. In the case where this damage is to the physical volume on which it resides, and any of these recovery data files exist on this volume as well, then complete recovery of the ACP database would be extremely difficult, if even possible.",
|
|
38
|
+
"severity": "medium"
|
|
39
|
+
},
|
|
40
|
+
{
|
|
41
|
+
"id": "V-105",
|
|
42
|
+
"title": "ACP database is not backed up on a scheduled basis.",
|
|
43
|
+
"description": "Loss of the ACP database would cause an interruption in the service of the operating system environment. If regularly scheduled backups of this database are not processed, system recovery time could be unacceptably long.",
|
|
44
|
+
"severity": "medium"
|
|
45
|
+
},
|
|
46
|
+
{
|
|
47
|
+
"id": "V-106",
|
|
48
|
+
"title": "System DASD backups are not performed on a regularly scheduled basis.",
|
|
49
|
+
"description": "If backups of the operating environment are not properly processed, implementation of a contingency plan would not include the data necessary to fully recover from any outage.",
|
|
50
|
+
"severity": "medium"
|
|
51
|
+
},
|
|
52
|
+
{
|
|
53
|
+
"id": "V-107",
|
|
54
|
+
"title": "PASSWORD data set and OS passwords are utilized.",
|
|
55
|
+
"description": "All protection of system resources must come from the ACP. If multiple protection mechanisms are in place, the accessibility of data, specifically under contingency plan execution, is subject to compromise.",
|
|
56
|
+
"severity": "medium"
|
|
57
|
+
},
|
|
58
|
+
{
|
|
59
|
+
"id": "V-108",
|
|
60
|
+
"title": "SYS1.PARMLIB is not limited to only system programmers.",
|
|
61
|
+
"description": "SYS1.PARMLIB contains the parameters which control system IPL, configuration characteristics, security facilities, and performance. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
62
|
+
"severity": "high"
|
|
63
|
+
},
|
|
64
|
+
{
|
|
65
|
+
"id": "V-109",
|
|
66
|
+
"title": "Access to SYS1.LINKLIB is not properly protected.",
|
|
67
|
+
"description": "This data set is automatically APF-authorized, contains system SVCs and the base PPT. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
68
|
+
"severity": "medium"
|
|
69
|
+
},
|
|
70
|
+
{
|
|
71
|
+
"id": "V-110",
|
|
72
|
+
"title": "Write or greater access to SYS1.SVCLIB must be limited to system programmers only.",
|
|
73
|
+
"description": "This data set is automatically APF-authorized, contains system SVCs, and may also contain I/O appendages. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
74
|
+
"severity": "high"
|
|
75
|
+
},
|
|
76
|
+
{
|
|
77
|
+
"id": "V-111",
|
|
78
|
+
"title": "Write or greater access to SYS1.IMAGELIB must be limited to system programmers only.\n ",
|
|
79
|
+
"description": "SYS1.IMAGELIB is a partitioned data set containing universal character set (UCS), forms control buffer (FCB), and printer control information. Most IBM standard UCS images are included in SYS1.IMAGELIB during system installation. This data set should be protected as a z/OS system data set.",
|
|
80
|
+
"severity": "high"
|
|
81
|
+
},
|
|
82
|
+
{
|
|
83
|
+
"id": "V-112",
|
|
84
|
+
"title": "Write or greater access to SYS1.LPALIB must be limited to system programmers only. \n ",
|
|
85
|
+
"description": "SYS1.LPALIB is automatically APF-authorized during IPL processing and can contain SVCs. LPA modules, once loaded into the Link Pack Area, are capable of performing APF-authorized functions. This authorization allows a program to bypass various levels of security checking. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
86
|
+
"severity": "high"
|
|
87
|
+
},
|
|
88
|
+
{
|
|
89
|
+
"id": "V-113",
|
|
90
|
+
"title": "Update and allocate access to all APF -authorized libraries are not limited to system programmers only. ",
|
|
91
|
+
"description": "The Authorized Program List designates those libraries that can contain program modules which possess a significant level of security bypass capability. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
92
|
+
"severity": "high"
|
|
93
|
+
},
|
|
94
|
+
{
|
|
95
|
+
"id": "V-114",
|
|
96
|
+
"title": "Write or greater access to all LPA libraries must be limited to system programmers only.",
|
|
97
|
+
"description": "LPA modules, once loaded into the Link Pack Area, are capable of performing APF-authorized functions. This authorization allows a program to bypass various levels of security checking. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
98
|
+
"severity": "high"
|
|
99
|
+
},
|
|
100
|
+
{
|
|
101
|
+
"id": "V-115",
|
|
102
|
+
"title": "Write or greater access to SYS1.NUCLEUS must be limited to system programmers only. ",
|
|
103
|
+
"description": "This data set contains a large portion of the system initialization (IPL) programs and pointers to the master and alternate master catalog. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
104
|
+
"severity": "high"
|
|
105
|
+
},
|
|
106
|
+
{
|
|
107
|
+
"id": "V-116",
|
|
108
|
+
"title": "Write or greater access to libraries that contain PPT modules must be limited to system programmers only.",
|
|
109
|
+
"description": "Specific PPT designated program modules possess significant security bypass capabilities. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
110
|
+
"severity": "high"
|
|
111
|
+
},
|
|
112
|
+
{
|
|
113
|
+
"id": "V-117",
|
|
114
|
+
"title": "Update and allocate access to LINKLIST libraries are not limited to system programmers only. ",
|
|
115
|
+
"description": "The primary function of the LINKLIST is to serve as a single repository for commonly used system modules. Failure to ensure that the proper set of libraries are designated for LINKLIST can impact system integrity, performance, and functionality. For this reason, controls must be employed to ensure that the correct set of LINKLIST libraries are used. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
116
|
+
"severity": "medium"
|
|
117
|
+
},
|
|
118
|
+
{
|
|
119
|
+
"id": "V-118",
|
|
120
|
+
"title": "The ACP security data sets and/or databases must be properly protected.",
|
|
121
|
+
"description": "The Access Control Program (ACP) database files contain all access control information for the operating system environment and system resources. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
122
|
+
"severity": "high"
|
|
123
|
+
},
|
|
124
|
+
{
|
|
125
|
+
"id": "V-119",
|
|
126
|
+
"title": "Access greater than Read to the System Master Catalog must be limited to system programmers only. ",
|
|
127
|
+
"description": "System catalogs are the basis for locating all files on the system. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.\n",
|
|
128
|
+
"severity": "high"
|
|
129
|
+
},
|
|
130
|
+
{
|
|
131
|
+
"id": "V-120",
|
|
132
|
+
"title": "Update and allocate access to all system-level product installation libraries are not limited to system programmers only. ",
|
|
133
|
+
"description": "System-level product installation libraries constitute the majority of the systems software libraries. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
134
|
+
"severity": "medium"
|
|
135
|
+
},
|
|
136
|
+
{
|
|
137
|
+
"id": "V-121",
|
|
138
|
+
"title": "Update and allocate access to the JES2 System data sets (e.g., Spool, Checkpoint, and Initialization parameters) are not limited to system programmers only. ",
|
|
139
|
+
"description": "The JES2 System data sets are a common repository for all jobs submitted to the system and the associated printout and configuration of the JES2 environment. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
140
|
+
"severity": "medium"
|
|
141
|
+
},
|
|
142
|
+
{
|
|
143
|
+
"id": "V-122",
|
|
144
|
+
"title": "Write or greater access to SYS1.UADS must be limited to system programmers only and read and update access must be limited to system programmer personnel and/or security personnel.",
|
|
145
|
+
"description": "SYS1.UADS is the data set where emergency USERIDs are maintained. This ensures that logon processing can occur even if the ACP is not functional. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
146
|
+
"severity": "high"
|
|
147
|
+
},
|
|
148
|
+
{
|
|
149
|
+
"id": "V-123",
|
|
150
|
+
"title": "Update and allocate access to SMF collection files (i.e., SYS1.MANx) are not limited to system programmers and/or batch jobs that perform SMF dump processing. ",
|
|
151
|
+
"description": "SMF data collection is the system activity journaling facility of the z/OS system. With the proper parameter designations it serves as the basis to ensure individual user accountability. SMF data is the primary source for cost charge back in DISA. Unauthorized access could result in the compromise of logging and recording of the operating system environment, ACP, and customer data.",
|
|
152
|
+
"severity": "medium"
|
|
153
|
+
},
|
|
154
|
+
{
|
|
155
|
+
"id": "V-124",
|
|
156
|
+
"title": "Update and allocate access to data sets used to backup and/or dump SMF collection files are not limited to system programmers and/or batch jobs that perform SMF dump processing. ",
|
|
157
|
+
"description": "SMF backup data sets are those data sets to which SMF data has been offloaded in order to ensure a historical tracking of individual user accountability. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
158
|
+
"severity": "medium"
|
|
159
|
+
},
|
|
160
|
+
{
|
|
161
|
+
"id": "V-125",
|
|
162
|
+
"title": "Access to SYSTEM DUMP data sets are not limited to system programmers only. ",
|
|
163
|
+
"description": "System DUMP data sets are used to record system data areas and virtual storage associated with system task failures. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
164
|
+
"severity": "medium"
|
|
165
|
+
},
|
|
166
|
+
{
|
|
167
|
+
"id": "V-126",
|
|
168
|
+
"title": "Update and allocate access to System backup files are not limited to system programmers and/or batch jobs that perform DASD backups.",
|
|
169
|
+
"description": "System backup data sets are necessary for recovery of DASD resident data sets. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
170
|
+
"severity": "medium"
|
|
171
|
+
},
|
|
172
|
+
{
|
|
173
|
+
"id": "V-127",
|
|
174
|
+
"title": "Access to SYS(x).TRACE is not limited to system programmers only.",
|
|
175
|
+
"description": "SYS1.TRACE is used to trace and debug system problems. Unauthorized access could result in a compromise of the integrity and availability of all system data and processes.",
|
|
176
|
+
"severity": "medium"
|
|
177
|
+
},
|
|
178
|
+
{
|
|
179
|
+
"id": "V-128",
|
|
180
|
+
"title": "Access to System page data sets (i.e., PLPA, COMMON, and LOCALx) are not limited to system programmers.",
|
|
181
|
+
"description": "Page data sets hold individual pages of virtual storage when they are paged out of real storage. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
182
|
+
"severity": "medium"
|
|
183
|
+
},
|
|
184
|
+
{
|
|
185
|
+
"id": "V-129",
|
|
186
|
+
"title": "Write or greater access to Libraries containing EXIT modules must be limited to system programmers only.",
|
|
187
|
+
"description": "System exits have a wide range of uses and capabilities within any system. Exits may introduce security exposures within the system, modify audit trails, and alter individual user capabilities. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
188
|
+
"severity": "high"
|
|
189
|
+
},
|
|
190
|
+
{
|
|
191
|
+
"id": "V-15209",
|
|
192
|
+
"title": "Site does not maintain documented procedures to apply security related software patches to their system and does not maintain a log of when these patches were applied.",
|
|
193
|
+
"description": "Vendors' code may contain vulnerabilities that may be exploited to cause denial of service or to violate the integrity of the system or data on the System. Most vendors develop patches to correct these vulnerabilities. These patches must be applied and documented. ",
|
|
194
|
+
"severity": "high"
|
|
195
|
+
},
|
|
196
|
+
{
|
|
197
|
+
"id": "V-17839",
|
|
198
|
+
"title": "Batch job user Ids must be properly defined.",
|
|
199
|
+
"description": "Batch jobs are submitted to the operating system under their own USERID. This will identify the batch job with the user for the purpose of accessing resources. BATCHALLRACF ensures that a valid USERID is associated with batch jobs. Jobs that are submitted to the operating system via a scheduling facility must also be identified to the system. Without a batch job having an associated USERID, access to system resources will be limited.",
|
|
200
|
+
"severity": "medium"
|
|
201
|
+
},
|
|
202
|
+
{
|
|
203
|
+
"id": "V-182",
|
|
204
|
+
"title": "Memory and privileged program dumps must be protected in accordance with proper security requirements.",
|
|
205
|
+
"description": "Access to memory and privileged program dumps running Trusted Control Block (TCB) key 0-7 may hold passwords, encryption keys, or other sensitive data that must not be made available. Failure to properly control access to these facilities could result in unauthorized personnel modifying sensitive z/OS lists. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.",
|
|
206
|
+
"severity": "medium"
|
|
207
|
+
},
|
|
208
|
+
{
|
|
209
|
+
"id": "V-184",
|
|
210
|
+
"title": "LOGONIDs must not be defined to SYS1.UADS for non-emergency use.",
|
|
211
|
+
"description": "SYS1.UADS is a dataset where LOGONIDs will be maintained with applicable password information when the ACP is not functional. If an unauthorized user has access to SYS1.UADS, they could enter their LOGONID and password into the SYS1.UADS dataset and could give themselves all special attributes on the system. This could enable the user to bypass all security and alter data. They could modify the audit trail information so no trace of their activity could be found.",
|
|
212
|
+
"severity": "high"
|
|
213
|
+
},
|
|
214
|
+
{
|
|
215
|
+
"id": "V-234",
|
|
216
|
+
"title": "All system PROCLIB data sets must be limited to system programmers only",
|
|
217
|
+
"description": "Unauthorized access to PROCLIB data sets referenced in the JES2 procedure can allow unauthorized modifications to STCs and other system level procedures. This could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
218
|
+
"severity": "high"
|
|
219
|
+
},
|
|
220
|
+
{
|
|
221
|
+
"id": "V-23837",
|
|
222
|
+
"title": "z/OS Baseline reports are not reviewed and validated to ensure only authorized changes have been made within the z/OS operating system. This is a current DISA requirement for change management to system libraries.",
|
|
223
|
+
"description": "A product that generates reports validating changes, additions or removal from APF and LPA libraries, as well as changes to SYS1.PARMLIB PDS members, should be run against system libraries to provide a baseline analysis to allow monitoring of changes to these libraries. Failure to monitor and review these reports on a regular bases and validating any changes could threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data. ",
|
|
224
|
+
"severity": "medium"
|
|
225
|
+
},
|
|
226
|
+
{
|
|
227
|
+
"id": "V-251",
|
|
228
|
+
"title": "Sensitive CICS transactions are not protected in accordance with security requirements.",
|
|
229
|
+
"description": "Sensitive CICS transactions offer the ability to circumvent transaction level controls for accessing resources under CICS. These transactions must be protected so that only authorized users can access them. Unauthorized use can result in the compromise of the confidentiality, integrity, and availability of the operating system or customer data.",
|
|
230
|
+
"severity": "medium"
|
|
231
|
+
},
|
|
232
|
+
{
|
|
233
|
+
"id": "V-254",
|
|
234
|
+
"title": "The Automatic Data Set Protection (ADSP) SETROPTS value is not set to NOADSP.",
|
|
235
|
+
"description": "(RACF0250: CAT II) ADSP indicates that RACF automatically creates discrete data set profiles to protect datasets created by users having this attribute.\n\nADSP specifies that data sets created by users who have the ADSP attribute will be RACF protected automatically. NOADSP cancels automatic RACF protection for users who have ADSP.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
236
|
+
"severity": "medium"
|
|
237
|
+
},
|
|
238
|
+
{
|
|
239
|
+
"id": "V-255",
|
|
240
|
+
"title": "The AUDIT SETROPTS value is improperly set.",
|
|
241
|
+
"description": "(RACF0260: CAT II) AUDIT specifies the names of the classes for which you want RACF to perform auditing. For the classes that you specify, RACF logs all uses of the RACDEF SVC and all changes made to profiles by RACF commands. NOAUDIT cancels auditing.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
242
|
+
"severity": "medium"
|
|
243
|
+
},
|
|
244
|
+
{
|
|
245
|
+
"id": "V-256",
|
|
246
|
+
"title": "The CLASSACT SETROPTS must be specified for the TEMPDSN Class. ",
|
|
247
|
+
"description": "CLASSACT specifies those classes defined by entries in the class descriptor table for which RACF checking is to be ACTIVE. DATASET, USER, and GROUP are active by default and cannot be activated or deactivated.\n\nThe system-wide options control the default settings for determining how the Access Control Program (ACP) will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
248
|
+
"severity": "medium"
|
|
249
|
+
},
|
|
250
|
+
{
|
|
251
|
+
"id": "V-257",
|
|
252
|
+
"title": "The CMDVIOL SETROPTS value is not set to CMDVIOL. ",
|
|
253
|
+
"description": "(RACF0280: CAT II) The CMDVIOL specifies whether RACF is to log violations detected by RACF commands. You must have the auditor attribute to specify these commands. A violation may occur because a user is not authorized to modify a particular profile, or is not authorized to enter a particular operand on a command.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
254
|
+
"severity": "medium"
|
|
255
|
+
},
|
|
256
|
+
{
|
|
257
|
+
"id": "V-258",
|
|
258
|
+
"title": "The EGN SETROPTS value specified is not set to EGN.",
|
|
259
|
+
"description": "(RACF0290: CAT II) EGN changes the meaning of the signle generic character *. The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
260
|
+
"severity": "medium"
|
|
261
|
+
},
|
|
262
|
+
{
|
|
263
|
+
"id": "V-259",
|
|
264
|
+
"title": "The ERASE ALL SETROPTS value must be set to ERASE(ALL) on all systems.",
|
|
265
|
+
"description": "The ERASE ALL specifies that data management is to erase all scratched data sets including temporary data sets. NOERASE specifies that no DASD data sets are erased when deleted.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
266
|
+
"severity": "medium"
|
|
267
|
+
},
|
|
268
|
+
{
|
|
269
|
+
"id": "V-260",
|
|
270
|
+
"title": "The GENCMD SETROPTS value is not enabled for ACTIVE classes.",
|
|
271
|
+
"description": "(RACF0310: CAT II) The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
272
|
+
"severity": "medium"
|
|
273
|
+
},
|
|
274
|
+
{
|
|
275
|
+
"id": "V-261",
|
|
276
|
+
"title": "The GENERIC SETROPTS value is not enabled for ACTIVE classes.",
|
|
277
|
+
"description": "(RACF0320: CAT II) The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
278
|
+
"severity": "medium"
|
|
279
|
+
},
|
|
280
|
+
{
|
|
281
|
+
"id": "V-262",
|
|
282
|
+
"title": "The TERMINAL SETROPTS value is not set to READ.",
|
|
283
|
+
"description": "(RACF0330: CAT II) TERMINAL is used to set the universal access authority (UACC) associated with undefined terminals. If you specify TERMINAL, but do not specify read or none, the system will prompt you for a value.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
284
|
+
"severity": "medium"
|
|
285
|
+
},
|
|
286
|
+
{
|
|
287
|
+
"id": "V-263",
|
|
288
|
+
"title": "The PASSWORD(MINCHANGE) value will specified a value greater the zero (0).",
|
|
289
|
+
"description": "MINCHANGE specifies the number of days that must pass between a user’s password and password phrase changes. Users can not change their own passwords and password phrases within the minimum change interval.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
290
|
+
"severity": "medium"
|
|
291
|
+
},
|
|
292
|
+
{
|
|
293
|
+
"id": "V-264",
|
|
294
|
+
"title": "The INACTIVE SETROPTS value is not set to 35 days.",
|
|
295
|
+
"description": "The system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
296
|
+
"severity": "medium"
|
|
297
|
+
},
|
|
298
|
+
{
|
|
299
|
+
"id": "V-265",
|
|
300
|
+
"title": "The GRPLIST SETROPTS value is not set to ACTIVE.",
|
|
301
|
+
"description": "(RACF0350: CAT II) GRPLIST specifies that RACF processing is to perform group list access checking for all system users. When you specify GRPLIST, a users authority to access a resource is not based only on the authority of the users current connect group; access is based on the authority of any group to which the user is connected.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
302
|
+
"severity": "medium"
|
|
303
|
+
},
|
|
304
|
+
{
|
|
305
|
+
"id": "V-266",
|
|
306
|
+
"title": "The INITSTATS SETROPTS value is not set to INITSTATS.",
|
|
307
|
+
"description": "RACF0370: CAT II) INITSTATS specifies statistics available during RACINIT SVC processing are to be recorded. These statistics include the date and time RACINIT is issued for a particular user, the number of RACINITs for a user to a particular group, and the date and time of the last RACINIT for a user to a particular group.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
308
|
+
"severity": "medium"
|
|
309
|
+
},
|
|
310
|
+
{
|
|
311
|
+
"id": "V-267",
|
|
312
|
+
"title": "The JES(BATCHALLRACF) SETROPTS value is not set to JES(BATCHALLRACF).",
|
|
313
|
+
"description": "(RACF0380: CAT II) JES(BATCHALLRACF) specifies that JES is to test for the presence of a USERID and password on the job statement or for propagated RACF identification information for all batch jobs.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
314
|
+
"severity": "medium"
|
|
315
|
+
},
|
|
316
|
+
{
|
|
317
|
+
"id": "V-269",
|
|
318
|
+
"title": "The JES(XBMALLRACF) SETROPTS value is not set to JES(XBMALLRACF).",
|
|
319
|
+
"description": "(RACF0400: CAT II) XBMALLRACF ensures that (assuming you have JES configured to support XBM jobs) any XBM job submitted by a user must have a RACF identity or the job\nwill fail. This is used only in JES2.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
320
|
+
"severity": "medium"
|
|
321
|
+
},
|
|
322
|
+
{
|
|
323
|
+
"id": "V-270",
|
|
324
|
+
"title": "The OPERAUDIT SETROPTS value is not set to OPERAUDIT.",
|
|
325
|
+
"description": "(RACF0420: CAT II) OPERAUDIT specifies whether RACF is to log all actions, such as accesses to resources and commands, allowed only because a user has the OPERATIONS or group OPERATIONS attribute.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
326
|
+
"severity": "medium"
|
|
327
|
+
},
|
|
328
|
+
{
|
|
329
|
+
"id": "V-271",
|
|
330
|
+
"title": "The PASSWORD(HISTORY) SETROPTS value is not set to 10.",
|
|
331
|
+
"description": "(RACF0430: CAT II) HISTORY specifies the number of previous passwords that RACF saves for each USERID and compares with an intended new password. If there is a match with one of the previous passwords, or with the current password, RACF rejects the intended new password.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
332
|
+
"severity": "medium"
|
|
333
|
+
},
|
|
334
|
+
{
|
|
335
|
+
"id": "V-272",
|
|
336
|
+
"title": "The PASSWORD(INTERVAL) SETROPTS value is not set to 60 days.",
|
|
337
|
+
"description": "(RACF0440: CAT II) INTERVAL specifies the maximum number of days that each users password is valid. When a user logs on to the system, RACF compares the system password interval value specified in the user profile. RACF uses the lower of the two values to determine if the users password has expired.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
338
|
+
"severity": "medium"
|
|
339
|
+
},
|
|
340
|
+
{
|
|
341
|
+
"id": "V-273",
|
|
342
|
+
"title": "The PASSWORD(REVOKE) SETROPTS value specified is not in accordance with security requirements.",
|
|
343
|
+
"description": "(RACF0450: CAT II) The IAO will ensure that PASSWORD(REVOKE) SETROPTS value is\nset to 1 or 2. This value specifies the number of consecutive incorrect password attempts RACF allows before it revokes the USERID on the next incorrect attempt. If you specify REVOKE, ensure\nINITSTATS are in effect. \n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
344
|
+
"severity": "medium"
|
|
345
|
+
},
|
|
346
|
+
{
|
|
347
|
+
"id": "V-274",
|
|
348
|
+
"title": "The PASSWORD(RULEn) SETROPTS value(s) must be properly set.",
|
|
349
|
+
"description": "Password complexity, or strength, is a measure of the effectiveness of a password in resisting guessing and brute-force attacks. Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised. Use of a complex password helps to increase the time and resources required to compromise the password.\n\nThe PASSWORD SETROPTS value(s) specify the rules that RACF will apply when a user selects a new password. Improper setting of any of these fields, individually or in combination with another, can result in weakened passwords and compromise the security of the processing environment.",
|
|
350
|
+
"severity": "medium"
|
|
351
|
+
},
|
|
352
|
+
{
|
|
353
|
+
"id": "V-275",
|
|
354
|
+
"title": "The PASSWORD(WARNING) SETROPTS value is improperly set.",
|
|
355
|
+
"description": "WARNING specifies the number of days before a password expires when RACF\nis to issue a warning message to the user. \n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
356
|
+
"severity": "medium"
|
|
357
|
+
},
|
|
358
|
+
{
|
|
359
|
+
"id": "V-276",
|
|
360
|
+
"title": "The PROTECTALL SETROPTS value specified is improperly set.",
|
|
361
|
+
"description": "When PROTECTALL processing is active and set to FAIL, the system automatically rejects any request to create or access a data set that is not RACF protected.\n\nTemporary data sets that comply with standard MVS temporary data set naming conventions are excluded from PROTECTALL processing. PROTECTALL requires that data sets be RACF protected. In order for PROTECTALL to work effectively, you must specify GENERIC to activate generic profile checking. Otherwise, RACF would allow users to create or access only data sets protected by discrete profiles.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
362
|
+
"severity": "high"
|
|
363
|
+
},
|
|
364
|
+
{
|
|
365
|
+
"id": "V-277",
|
|
366
|
+
"title": "The REALDSN SETROPTS value specified is improperly set.",
|
|
367
|
+
"description": "REALDSN specifies that RACF is to record, in any SMF log records and operator messages, the real data set name (not the naming-conventions name) used on the data set commands and during resource access checking and resource definition.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
368
|
+
"severity": "low"
|
|
369
|
+
},
|
|
370
|
+
{
|
|
371
|
+
"id": "V-278",
|
|
372
|
+
"title": "The RETPD SETROPTS value specified is improperly set.",
|
|
373
|
+
"description": "RETPD specifies the default RACF security retention period for tape data sets. The security\nretention period is the number of days that RACF protection is to remain in effect for the\ntape data set and should be set to a value of 99999.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
374
|
+
"severity": "medium"
|
|
375
|
+
},
|
|
376
|
+
{
|
|
377
|
+
"id": "V-279",
|
|
378
|
+
"title": "The SETROPTS RVARYPW values will be properly set.",
|
|
379
|
+
"description": "RVARYPW specifies passwords that an operator is to use to respond with requests to approve RVARY command processing.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
380
|
+
"severity": "medium"
|
|
381
|
+
},
|
|
382
|
+
{
|
|
383
|
+
"id": "V-280",
|
|
384
|
+
"title": "The SAUDIT SETROPTS value specified is improperly set.",
|
|
385
|
+
"description": "SAUDIT specifies whether RACF is to log all RACF commands issued by users with the\nSPECIAL or group SPECIAL attribute.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
386
|
+
"severity": "medium"
|
|
387
|
+
},
|
|
388
|
+
{
|
|
389
|
+
"id": "V-282",
|
|
390
|
+
"title": "The TAPEDSN SETROPTS value specified is improperly set.",
|
|
391
|
+
"description": "TAPEDSN activates tape data set protection. When tape data set protection is\nin effect, RACF can protect individual tape data sets as well as tape volumes.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
392
|
+
"severity": "medium"
|
|
393
|
+
},
|
|
394
|
+
{
|
|
395
|
+
"id": "V-283",
|
|
396
|
+
"title": "The WHEN(PROGRAM) SETROPTS value specified is not active.",
|
|
397
|
+
"description": "WHEN(PROGRAM) activates RACF program control, which\nincludes both access control to load modules and program access to data sets.\n\nThe system-wide options control the default settings for determining how the ACP will function when handling requests for access to the operating system environment, ACP, and customer data. The ACP provides the ability to set a number of these fields at the subsystem level. If no setting is found, the system-wide defaults will be used. The improper setting of any of these fields, individually or in combination with another, can compromise the security of the processing environment. In addition, failure to establish standardized settings for the ACP control options introduces the possibility of exposure during migration process or contingency plan activation.",
|
|
398
|
+
"severity": "medium"
|
|
399
|
+
},
|
|
400
|
+
{
|
|
401
|
+
"id": "V-284",
|
|
402
|
+
"title": "RACF users do not have the required default fields. ",
|
|
403
|
+
"description": "Ensure that Every USERID is uniquely identified to the system. Within the USERID record, the user's name, default group, the owner, and the user's passdate fields are completed. This will uniquely identify each user. If these fields are not completed for each user, user accountability will become lost.\n\nEvery user will be identified to RACF via each user’s unique userid profile. To RACF, a user is\nan individual (user), a started task, or a batch job. Every userid will be fully identified within\nRACF with the following fields completed:\nNAME User’s name\nDFLTGRP Default group\nOWNER User’s profile owner\nPASSWORD Password\n\nRACF will automatically assign the default group as the password if a password is not explicitly\ncoded. Assign a unique password to every userid to prevent unauthorized access by a person\nwho knows the default group for a new userid.",
|
|
404
|
+
"severity": "low"
|
|
405
|
+
},
|
|
406
|
+
{
|
|
407
|
+
"id": "V-285",
|
|
408
|
+
"title": "Interactive USERIDs defined to RACF must have the required fields completed.",
|
|
409
|
+
"description": "Improper assignments of attributes in the LOGONID record may allow users excessive privileges resulting in unauthorized access.",
|
|
410
|
+
"severity": "medium"
|
|
411
|
+
},
|
|
412
|
+
{
|
|
413
|
+
"id": "V-286",
|
|
414
|
+
"title": "RACF batch jobs are improperly secured.",
|
|
415
|
+
"description": "Batch jobs that are submitted to the operating system should inherit the USERID of the submitter. This will identify the batch job with a userid for the purpose of accessing resources. BATCHALLRACF ensures that a valid USERID is associated with batch jobs. Jobs that are submitted to the operating system via a scheduling facility must also be identified to the system. Without a batch job having an associated USERID, access to system resources will be limited.",
|
|
416
|
+
"severity": "medium"
|
|
417
|
+
},
|
|
418
|
+
{
|
|
419
|
+
"id": "V-28603",
|
|
420
|
+
"title": "z/OS USS Software owning Shared accounts do not meet strict security and creation restrictions. ",
|
|
421
|
+
"description": "Shared accounts by nature are a violation of proper audit trail and proper user authentication. If not properly controlled, could cause system corruption without an audit trail tracking session\nactivity to an individual user's identity.\n\n",
|
|
422
|
+
"severity": "medium"
|
|
423
|
+
},
|
|
424
|
+
{
|
|
425
|
+
"id": "V-287",
|
|
426
|
+
"title": "RACF batch jobs are not protected with propagation control.",
|
|
427
|
+
"description": "Batch jobs that are user-submitted to the operating system should inherit the USERID of the submitter. This will identify the batch job with the user for the purpose of accessing resources. In some environments, such as CICS, jobs submitted without the USER operand specified on the JOB statement run under a user ID other than the user submitting the job, in this case, the CICS userid. This situation presents a security violation in that the issuer of the job will inherit the authority of the CICS userid. \n\nThe PROPCNTL Class was designed to prevent this from occurring. Utilize propagation control (PROPCNTL) for system-level address spaces that submit jobs on behalf of users.",
|
|
428
|
+
"severity": "medium"
|
|
429
|
+
},
|
|
430
|
+
{
|
|
431
|
+
"id": "V-288",
|
|
432
|
+
"title": "Started Tasks are not properly identified to RACF.",
|
|
433
|
+
"description": "Started procedures have system generated job statements that do not contain the user, group, or password statements. To enable the started procedure to access the same protected resources that users and groups access, started procedures must have an associated USERID. If a USERID is not associated with the started procedure, the started procedure will not have access to the resources.",
|
|
434
|
+
"severity": "medium"
|
|
435
|
+
},
|
|
436
|
+
{
|
|
437
|
+
"id": "V-289",
|
|
438
|
+
"title": "Started Tasks are improperly defined to RACF.",
|
|
439
|
+
"description": "Started procedures have system generated job statements that do not contain the user, group, or password statements. To enable the started procedure to access the same protected resources that users and groups access, started procedures must have an associated USERID. If a USERID is not associated with the started procedure, the started procedure will not have access to the resources. If the started procedure is associated with an incorrect user or a user with higher than necessary authority then a potential vulnerability exists.",
|
|
440
|
+
"severity": "medium"
|
|
441
|
+
},
|
|
442
|
+
{
|
|
443
|
+
"id": "V-290",
|
|
444
|
+
"title": "DASD Management USERIDs must be properly controlled.",
|
|
445
|
+
"description": "DASD management USERIDs require access to backup and restore all files, and present a high degree of risk to the environment. These users should be given access to perform necessary functions thru use of the DASDVOL class (for non-SMS volumes) and/or thru STGADMIN profiles in the FACILITY class for SMS managed volumes. Access to individual profiles in the DATASET class should be disallowed. These userids should also set up IAW RACF0595 for batch userids which includes use of the PROTECTED Attribute.",
|
|
446
|
+
"severity": "medium"
|
|
447
|
+
},
|
|
448
|
+
{
|
|
449
|
+
"id": "V-291",
|
|
450
|
+
"title": "There are started tasks defined to RACF with the trusted attribute that are not justified.",
|
|
451
|
+
"description": "Trusted Started tasks bypass RACF checking. It is vital that this attribute is NOT granted to unauthorized Started Tasks which could then obtain unauthorized access to the system. This could result in the compromise of the confidentiality, integrity, and availability of the operating system, ACP, or customer data.",
|
|
452
|
+
"severity": "medium"
|
|
453
|
+
},
|
|
454
|
+
{
|
|
455
|
+
"id": "V-292",
|
|
456
|
+
"title": "Emergency USERIDs must be properly defined.",
|
|
457
|
+
"description": "Emergency USERIDs are necessary in the event of a system outage for recovery purposes. It is critical that those USERIDs be defined with the appropriate access to ensure timely restoration of services.\n\n",
|
|
458
|
+
"severity": "medium"
|
|
459
|
+
},
|
|
460
|
+
{
|
|
461
|
+
"id": "V-293",
|
|
462
|
+
"title": "The use of the RACF SPECIAL Attribute is not justified.",
|
|
463
|
+
"description": "The SPECIAL user attribute allows full authorization to modify all profiles in the RACF database and allows the user to perform all RACF functions, except those requiring AUDITOR attributes. This privilege should be limited to the security group and administrators because of the extreme control that these users have. Users with this privilege can alter any profile or resource on the system and could also alter the audit trail information.\n\nThe Group-Special attribute allows decentralized RACF control of datasets and resources. In cases where the scope of authority granted to a Group-Special Administrator has an impact on system security, the IAO needs to be fully aware and approve its use.\n",
|
|
464
|
+
"severity": "medium"
|
|
465
|
+
},
|
|
466
|
+
{
|
|
467
|
+
"id": "V-294",
|
|
468
|
+
"title": "Assignment of the RACF OPERATIONS attribute to individual userids is not fully justified.\n",
|
|
469
|
+
"description": "A user possessing the OPERATIONS attribute has authorization to do maintenance operations on all RACF-protected data sets, tape volumes, and DASD volumes except those where the access list specifically limits the OPERATIONS user to a lower access authority than the operation requires.\n\nBecause the OPERATIONS and GROUP-OPERATIONS privileges allow widespread access they should be limited to users documented with a valid requirement. Delegation of GROUP-OPERATIONS processing to other personnel by site-defined Group Administrators is forbidden.\n",
|
|
470
|
+
"severity": "medium"
|
|
471
|
+
},
|
|
472
|
+
{
|
|
473
|
+
"id": "V-295",
|
|
474
|
+
"title": "The use of the RACF AUDITOR privilege is not justified.",
|
|
475
|
+
"description": "A user having the AUDITOR attribute has the authority to specify logging options, gives control of logging SMF data and list auditing information. With the AUDITOR attribute, a user could alter SMF logging data so no trace of the activity could be found. This could destroy audit trace information for the RACF system. This attribute should be limited to a minimum number of people. This also applies to the use of Group-Auditor in cases where users are connected to sensitive system dataset HLQ or general resource owning groups with Group-Auditor.\n\n",
|
|
476
|
+
"severity": "medium"
|
|
477
|
+
},
|
|
478
|
+
{
|
|
479
|
+
"id": "V-29532",
|
|
480
|
+
"title": "IEASYMUP resource will be protected in accordance with proper security requirements.",
|
|
481
|
+
"description": "Failure to properly control access to the IEASYMUP resource could result in unauthorized\npersonnel modifying sensitive z/OS symbolics. This exposure may threaten the integrity and\navailability of the operating system environment.",
|
|
482
|
+
"severity": "medium"
|
|
483
|
+
},
|
|
484
|
+
{
|
|
485
|
+
"id": "V-296",
|
|
486
|
+
"title": "The number of USERIDs possessing the Tape Bypass Label Processing (BLP) privilege is not justified.\n",
|
|
487
|
+
"description": "BLP is extremely sensitive, as it allows the circumvention of security access checking for the data. When BLP is used in z/OS, the only verification that is done is for the data set name in the JCL. Any data set name can be used. A user could specify a data set name that he has access to, the job would pass the validation check, and the job would be processed, giving access to the data. BLP is typically used for tapes that are external to the tape management system used on the processor.\n\nBLP should be granted to only a limited number of people, preferably the tape librarian and a few key people from the operations staff. If an unauthorized user possesses BLP authority, they could potentially read any restricted tape and modify any information once it has been copied.",
|
|
488
|
+
"severity": "medium"
|
|
489
|
+
},
|
|
490
|
+
{
|
|
491
|
+
"id": "V-297",
|
|
492
|
+
"title": "TSOAUTH resources must be restricted to authorized users.",
|
|
493
|
+
"description": "The TSOAUTH resource class controls sensitive privileges, such as OPER, ACCOUNT, MOUNT, TESTAUTH, CONSOLE, and PARMLIB. Several of these privileges offer the ability, or provide a facility, to modify sensitive operating system resources. Failure to properly control and restrict access to these privileges may result in the compromise of the operating system environment, ACP, and customer data.",
|
|
494
|
+
"severity": "medium"
|
|
495
|
+
},
|
|
496
|
+
{
|
|
497
|
+
"id": "V-298",
|
|
498
|
+
"title": "DASD Volume level protection must be properly defined.",
|
|
499
|
+
"description": "Volume access grants default access to all data sets residing on a given volume. This presents an exposure in the case of a data set improperly placed on a volume or inappropriate access being granted to a volume.",
|
|
500
|
+
"severity": "medium"
|
|
501
|
+
},
|
|
502
|
+
{
|
|
503
|
+
"id": "V-299",
|
|
504
|
+
"title": "Sensitive Utility Controls will be properly defined and protected.",
|
|
505
|
+
"description": "Sensitive Utility Controls can run sensitive system privileges or controls, and potentially can circumvent system and security controls. Failure to properly control access to these resources could result in the compromise of the confidentiality, integrity, and availability of the operating system environment, system services, ACP, and customer data.",
|
|
506
|
+
"severity": "medium"
|
|
507
|
+
},
|
|
508
|
+
{
|
|
509
|
+
"id": "V-29952",
|
|
510
|
+
"title": "FTP Control cards will be properly stored in a secure PDS file. ",
|
|
511
|
+
"description": "FTP control cards carry unencrypted information such as userids, passwords and remote IP Addresses. Without a requirement to store this information separate from the JCL and in-stream JCL, it allows a security exposure by allowing read exposure to this information from anyone having access to the JCL libraries.",
|
|
512
|
+
"severity": "medium"
|
|
513
|
+
},
|
|
514
|
+
{
|
|
515
|
+
"id": "V-301",
|
|
516
|
+
"title": "External RACF Classes are not active for CICS transaction checking.",
|
|
517
|
+
"description": "Implement CICS transaction security by utilizing two distinct and unique RACF resource\nclasses (i.e., member and grouping) within each CICS region. If several CICS regions are\ngrouped in an MRO environment, it is permissible for those grouped regions to share a\ncommon pair of resource classes. Member classes contain a RACF discrete profile for\neach transaction. Grouping classes contain groups of transactions requiring equal\nprotection under RACF. Ideally, member classes contain no profiles, and all transactions\nare defined by groups in a grouping class.\n\nIf CICS Classes are not active, this could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.\n",
|
|
518
|
+
"severity": "medium"
|
|
519
|
+
},
|
|
520
|
+
{
|
|
521
|
+
"id": "V-302",
|
|
522
|
+
"title": "CICS System Initialization Table (SIT) parameter values must be specified in accordance with proper security requirements.",
|
|
523
|
+
"description": "The CICS SIT is used to define system operation and configuration parameters of a CICS system. Several of these parameters control the security within a CICS region. Failure to code the appropriate values could result in unexpected operations and degraded security. This exposure may result in unauthorized access impacting the confidentiality, integrity, and availability of the CICS region, applications, and customer data.",
|
|
524
|
+
"severity": "medium"
|
|
525
|
+
},
|
|
526
|
+
{
|
|
527
|
+
"id": "V-31",
|
|
528
|
+
"title": "DFSMS resources must be protected in accordance with the proper security requirements.",
|
|
529
|
+
"description": "DFSMS provides data, storage, program, and device management functions for the operating system. Some DFSMS storage administration functions allow a user to obtain a privileged status and effectively bypass all ACP data set and volume controls. Failure to properly protect DFSMS resources may result in unauthorized access. This exposure could compromise the availability and integrity of the operating system environment, system services, and customer data.",
|
|
530
|
+
"severity": "medium"
|
|
531
|
+
},
|
|
532
|
+
{
|
|
533
|
+
"id": "V-31561",
|
|
534
|
+
"title": "Production WebSphere MQ Remotes must utilize Certified Name Filters (CNF)",
|
|
535
|
+
"description": "IBM Websphere MQ can use a user ID associated with an ACP certificate as a channel user ID. When an entity at one end of an SSL channel receives a certificate from a remote connection, the entity asks The ACP if there is a user ID associated with that certificate. The entity uses that user ID as the channel user ID. If there is no user ID associated with the certificate, the entity uses the user ID under which the channel initiator is running. Without a validly defined Certificate Name Filter for the entity IBM Websphere MQ will set the channel user ID to the default.",
|
|
536
|
+
"severity": "medium"
|
|
537
|
+
},
|
|
538
|
+
{
|
|
539
|
+
"id": "V-3215",
|
|
540
|
+
"title": "Configuration files for the TCP/IP stack are not properly specified.",
|
|
541
|
+
"description": "The TCP/IP stack reads two configuration files to determine values for critical operational parameters. These file names are specified in multiple locations and, depending on the process, are referenced differently. Because system security is impacted by some of the parameter settings, specifying the file names explicitly in each location reduces ambiguity and ensures proper operations. Inappropriate values could result in undesirable operations and degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services.",
|
|
542
|
+
"severity": "medium"
|
|
543
|
+
},
|
|
544
|
+
{
|
|
545
|
+
"id": "V-3216",
|
|
546
|
+
"title": "TCPIP.DATA configuration statements for the TCP/IP stack must be properly specified.",
|
|
547
|
+
"description": "During the initialization of TCP/IP servers and clients, the TCPIP.DATA configuration file provides information that is essential for proper operations of TCP/IP applications. Inappropriate values could result in undesirable operations and degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services.",
|
|
548
|
+
"severity": "medium"
|
|
549
|
+
},
|
|
550
|
+
{
|
|
551
|
+
"id": "V-3217",
|
|
552
|
+
"title": "PROFILE.TCPIP configuration statements for the TCP/IP stack are not coded properly.",
|
|
553
|
+
"description": "The PROFILE.TCPIP configuration file provides system operation and configuration parameters for the TCP/IP stack. Inappropriate values could result in undesirable operations and degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services.",
|
|
554
|
+
"severity": "medium"
|
|
555
|
+
},
|
|
556
|
+
{
|
|
557
|
+
"id": "V-3218",
|
|
558
|
+
"title": "The permission bits and user audit bits for HFS objects that are part of the Base TCP/IP component must be configured properly.",
|
|
559
|
+
"description": "HFS directories and files of the Base TCP/IP component provide the configuration, operational, and executable properties of IBMs TCP/IP system product. Failure to properly secure these objects may lead to unauthorized access resulting in the compromise of the integrity and availability of the operating system environment, ACP, and customer data.",
|
|
560
|
+
"severity": "medium"
|
|
561
|
+
},
|
|
562
|
+
{
|
|
563
|
+
"id": "V-3219",
|
|
564
|
+
"title": "TCP/IP resources must be properly protected.",
|
|
565
|
+
"description": "The Communication Server access authorization is used to protect TCP/IP resources such as stack, network, port, and other SERVAUTH resources. These resources provide additional security checks for TCP/IP users. Failure to properly secure these TCP/IP resources could lead to unauthorized user access resulting in the compromise of some system services and possible compromise of data.",
|
|
566
|
+
"severity": "medium"
|
|
567
|
+
},
|
|
568
|
+
{
|
|
569
|
+
"id": "V-3220",
|
|
570
|
+
"title": "Started tasks for the Base TCP/IP component must be defined in accordance with security requirements.",
|
|
571
|
+
"description": "The TCP/IP started tasks require special privileges and access to sensitive resources to provide its system services. Failure to properly define and control these TCP/IP started tasks could lead to unauthorized access. This exposure may result in the compromise of the integrity and availability of the operating system environment, ACP, and customer data.",
|
|
572
|
+
"severity": "medium"
|
|
573
|
+
},
|
|
574
|
+
{
|
|
575
|
+
"id": "V-3221",
|
|
576
|
+
"title": "MVS data sets for the Base TCP/IP component are not properly protected,",
|
|
577
|
+
"description": "MVS data sets of the Base TCP/IP component provide the configuration, operational, and executable properties of IBMs TCP/IP system product. Failure to properly secure these data sets may lead to unauthorized access resulting in the compromise of the integrity and availability of the operating system environment, ACP, and customer data.",
|
|
578
|
+
"severity": "medium"
|
|
579
|
+
},
|
|
580
|
+
{
|
|
581
|
+
"id": "V-3222",
|
|
582
|
+
"title": "PROFILE.TCPIP configuration statements for the TN3270 Telnet Server are not properly specified.",
|
|
583
|
+
"description": "The PROFILE.TCPIP configuration file provides system operation and configuration parameters for the TN3270 Telnet Server. Several of these parameters have potential impact to system security. Failure to code the appropriate values could result in unexpected operations and degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services.",
|
|
584
|
+
"severity": "medium"
|
|
585
|
+
},
|
|
586
|
+
{
|
|
587
|
+
"id": "V-3223",
|
|
588
|
+
"title": "VTAM session setup controls for the TN3270 Telnet Server are not properly specified. ",
|
|
589
|
+
"description": "After a connection from a Telnet client to the TN3270 Telnet Server has been established, the process of session setup with a VTAM application occurs. A number of BEGINVTAM statements must be coded in a specific configuration to ensure adequate control to VTAM applications is maintained. Failure to code the appropriate statements could result in unauthorized access to the host and application resources. This exposure may impact data integrity or the availability of some system services.",
|
|
590
|
+
"severity": "medium"
|
|
591
|
+
},
|
|
592
|
+
{
|
|
593
|
+
"id": "V-3224",
|
|
594
|
+
"title": "The warning banner for the TN3270 Telnet Server is not specified or properly specified.",
|
|
595
|
+
"description": "A logon banner can be used to inform users about the environment during the initial logon. In the DISA environment, logon banners are used to warn users against unauthorized entry and the possibility of legal action for unauthorized users, and advise all users that system use constitutes consent to monitoring. Failure to display a logon warning banner without this type of information could adversely impact the ability to prosecute unauthorized users and users who abuse the system.",
|
|
596
|
+
"severity": "medium"
|
|
597
|
+
},
|
|
598
|
+
{
|
|
599
|
+
"id": "V-3226",
|
|
600
|
+
"title": "SSL encryption options for the TN3270 Telnet Server will be specified properly for each statement that defines a SECUREPORT or within the TELNETGLOBALS.",
|
|
601
|
+
"description": "During the SSL connection process a mutually acceptable encryption algorithm is selected by the server and client. This algorithm is used to encrypt the data that subsequently flows between the two. However, the level or strength of encryption can vary greatly. Certain configuration options can allow no encryption to be used and others can allow a relatively weak 40-bit algorithm to be used. Failure to properly enforce adequate encryption strength could result in the loss of data privacy.",
|
|
602
|
+
"severity": "medium"
|
|
603
|
+
},
|
|
604
|
+
{
|
|
605
|
+
"id": "V-3227",
|
|
606
|
+
"title": "SMF recording options for the TN3270 Telnet Server must be properly specified.",
|
|
607
|
+
"description": "The TN3270 Telnet Server can provide audit data in the form of SMF records. The SMF data produced provides information about individual sessions. This data includes the VTAM application, the remote and local IP addresses, and the remote and local IP port numbers. Failure to collect and retain audit data may contribute to the loss of accountability and hamper security audit activities.",
|
|
608
|
+
"severity": "medium"
|
|
609
|
+
},
|
|
610
|
+
{
|
|
611
|
+
"id": "V-3229",
|
|
612
|
+
"title": "The startup user account for the z/OS UNIX Telnet Server is not defined properly.",
|
|
613
|
+
"description": "The z/OS UNIX Telnet Server (i.e., otelnetd) requires a UID(0) to provide its system services. After the user enters their userid and password, otelnetd switches to the security context of the users account. Because the otelnetd account is only used until authentication is completed, there is no need to require a unique account for this function. This limits the number of privileged accounts defined to the ACP and reduces the exposure potential. Failure to properly define and control otelnetd could lead to unauthorized access resulting in the compromise of the integrity and availability of the operating system environment, ACP, and customer data.",
|
|
614
|
+
"severity": "medium"
|
|
615
|
+
},
|
|
616
|
+
{
|
|
617
|
+
"id": "V-3230",
|
|
618
|
+
"title": "Startup parameters for the z/OS UNIX Telnet Server are not specified properly.",
|
|
619
|
+
"description": "The z/OS UNIX Telnet Server (i.e., otelnetd) provides interactive access to the z/OS UNIX shell. During the initialization process, startup parameters are read to define the characteristics of each otelnetd instance. Some of these parameters have an impact on system security. Failure to specify the appropriate command options could result in degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services.",
|
|
620
|
+
"severity": "medium"
|
|
621
|
+
},
|
|
622
|
+
{
|
|
623
|
+
"id": "V-3231",
|
|
624
|
+
"title": "The warning banner for the z/OS UNIX Telnet Server is not specified or not properly specified.",
|
|
625
|
+
"description": "A logon banner can be used to inform users about the environment during the initial logon. Logon banners are used to warn users against unauthorized entry and the possibility of legal action for unauthorized users, and advise all users that system use constitutes consent to monitoring. Failure to display a logon warning banner without this type of information could adversely impact the ability to prosecute unauthorized users and users who abuse the system.",
|
|
626
|
+
"severity": "medium"
|
|
627
|
+
},
|
|
628
|
+
{
|
|
629
|
+
"id": "V-3232",
|
|
630
|
+
"title": "HFS objects for the z/OS UNIX Telnet Server will be properly protected. ",
|
|
631
|
+
"description": "HFS directories and files of the z/OS UNIX Telnet Server provide the configuration and executable properties of this product. Failure to properly secure these objects may lead to unauthorized access resulting in the compromise of the integrity and availability of the operating system environment, ACP, and customer data.",
|
|
632
|
+
"severity": "medium"
|
|
633
|
+
},
|
|
634
|
+
{
|
|
635
|
+
"id": "V-3233",
|
|
636
|
+
"title": "The FTP Server daemon is not defined with proper security parameters.",
|
|
637
|
+
"description": "The FTP Server daemon requires special privileges and access to sensitive resources to provide its system services. Failure to properly define and control the FTP Server daemon could lead to unauthorized access. This exposure may result in the compromise of the integrity and availability of the operating system environment, ACP, and customer data.",
|
|
638
|
+
"severity": "medium"
|
|
639
|
+
},
|
|
640
|
+
{
|
|
641
|
+
"id": "V-3234",
|
|
642
|
+
"title": "The startup parameters for the FTP include the ANONYMOUS, ANONYMOUS=, or INACTIVE keywords. The FTP daemon’s started task JCL does not specify the SYSTCPD and SYSFTPD DD statements for configuration files.",
|
|
643
|
+
"description": "During initialization, the FTP daemon reads JCL keywords and configuration files to determine values for critical operational parameters. Because system security is impacted by some of these parameter settings, controlling these options through the configuration file only and explicitly specifying the file locations reduces ambiguity, enhances security auditing, and ensures proper operations. Inappropriate values could result in undesirable operations and degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services.",
|
|
644
|
+
"severity": "medium"
|
|
645
|
+
},
|
|
646
|
+
{
|
|
647
|
+
"id": "V-3235",
|
|
648
|
+
"title": "FTP.DATA configuration statements for the FTP Server are not specified in accordance with requirements.",
|
|
649
|
+
"description": "The statements in the FTP.DATA configuration file specify the parameters and values that control the operation of the FTP Server components including the use of anonymous FTP. Several of the parameters must have specific settings to provide a secure configuration. Inappropriate values could result in undesirable operations and degraded security. This exposure may result in unauthorized access impacting data integrity or the availability of some system services.",
|
|
650
|
+
"severity": "medium"
|
|
651
|
+
},
|
|
652
|
+
{
|
|
653
|
+
"id": "V-3236",
|
|
654
|
+
"title": "User exits for the FTP Server must not be used without proper approval and documentation.",
|
|
655
|
+
"description": "Several user exit points in the FTP Server component are available to permit customization of its operating behavior. These exits can be used to modify functions such as FTP command usage, client connection controls, post processing tasks, and SMF record modifications. Without proper review and adequate documentation of these exit programs, undesirable operations and degraded security may result. This exposure could lead to unauthorized access impacting data integrity or the availability of some system services, or contribute to the loss of accountability and hamper security audit activities.",
|
|
656
|
+
"severity": "medium"
|
|
657
|
+
},
|
|
658
|
+
{
|
|
659
|
+
"id": "V-3237",
|
|
660
|
+
"title": "The warning banner for the FTP Server is not specified properely.",
|
|
661
|
+
"description": "A logon banner can be used to inform users about the environment during the initial logon. In the DISA environment, logon banners are used to warn users against unauthorized entry and the possibility of legal action for unauthorized users, and advise all users that system use constitutes consent to monitoring. Failure to display a logon warning banner without this type of information could adversely impact the ability to prosecute unauthorized users and users who abuse the system.",
|
|
662
|
+
"severity": "medium"
|
|
663
|
+
},
|
|
664
|
+
{
|
|
665
|
+
"id": "V-3238",
|
|
666
|
+
"title": "SMF recording options for the FTP Server must be configured to write SMF records for all eligible events.",
|
|
667
|
+
"description": "The FTP Server can provide audit data in the form of SMF records. The SMF data produced by the FTP Server provides transaction information for both successful and unsuccessful FTP commands. Failure to collect and retain audit data may contribute to the loss of accountability and hamper security audit activities.",
|
|
668
|
+
"severity": "medium"
|
|
669
|
+
},
|
|
670
|
+
{
|
|
671
|
+
"id": "V-3239",
|
|
672
|
+
"title": "The permission bits and user audit bits for HFS objects that are part of the FTP Server component will be properly configured.\n",
|
|
673
|
+
"description": "HFS directories and files of the FTP Server provide the configuration and executable properties of this product. Failure to properly secure these objects may lead to unauthorized access resulting in the compromise of the integrity and availability of the operating system environment, ACP, and customer data.",
|
|
674
|
+
"severity": "medium"
|
|
675
|
+
},
|
|
676
|
+
{
|
|
677
|
+
"id": "V-3240",
|
|
678
|
+
"title": "MVS data sets for the FTP Server are not properly protected.",
|
|
679
|
+
"description": "MVS data sets of the FTP Server provide the configuration and operational characteristics of this product. Failure to properly secure these data sets may lead to unauthorized access resulting in the compromise of the integrity and availability of customer data and some system services.",
|
|
680
|
+
"severity": "medium"
|
|
681
|
+
},
|
|
682
|
+
{
|
|
683
|
+
"id": "V-3241",
|
|
684
|
+
"title": "The TFTP Server program is not properly protected.",
|
|
685
|
+
"description": "The Trivial File Transfer Protocol (TFTP) Server, known as tftpd, supports file transfer according to the industry standard Trivial File Transfer Protocol. The TFTP Server does not perform any user identification or authentication, allowing any client to connect to the TFTP Server. Due to this lack of security, the TFTP Server will not be used. Failure to restrict the use of the TFTP Server may result in unauthorized access to the host. This exposure may impact the integrity, availability, and privacy of application data.",
|
|
686
|
+
"severity": "medium"
|
|
687
|
+
},
|
|
688
|
+
{
|
|
689
|
+
"id": "V-3242",
|
|
690
|
+
"title": "The Syslog daemon is not started at z/OS initialization.",
|
|
691
|
+
"description": "The Syslog daemon, known as SYSLOGD, is a z/OS UNIX daemon that provides a central processing point for log messages issued by other z/OS UNIX processes. The messages may be of varying importance levels including general process information, diagnostic information, critical error notification, and audit-class information. It is important that SYSLOGD be started during the initialization phase of the z/OS system to ensure that significant messages are not lost. Failure to collect and retain audit data may contribute to the loss of accountability and hamper security audit activities.",
|
|
692
|
+
"severity": "medium"
|
|
693
|
+
},
|
|
694
|
+
{
|
|
695
|
+
"id": "V-3243",
|
|
696
|
+
"title": "The Syslog daemon must be properly defined and secured.",
|
|
697
|
+
"description": "The Syslog daemon, known as syslogd, is a zOS UNIX daemon that provides a central processing point for log messages issued by other zOS UNIX processes. It is also possible to receive log messages from other network-connected hosts. Some of the IBM Communications Server components that may send messages to syslog are the FTP, TFTP, zOS UNIX Telnet, DNS, and DHCP servers. The messages may be of varying importance levels including general process information, diagnostic information, critical error notification, and audit-class information. Primarily because of the potential to use this information in an audit process, there is a security interest in protecting the syslogd process and its associated data. \n\nThe Syslog daemon requires special privileges and access to sensitive resources to provide its system services. Failure to properly define and control the Syslog daemon could lead to unauthorized access. This exposure may result in the compromise of the integrity and availability of the operating system environment, ACP, and customer data.",
|
|
698
|
+
"severity": "medium"
|
|
699
|
+
},
|
|
700
|
+
{
|
|
701
|
+
"id": "V-3244",
|
|
702
|
+
"title": "The permission bits and user audit bits for HFS objects that are part of the Syslog daemon component will be configured properly.",
|
|
703
|
+
"description": "HFS directories and files of the Syslog daemon provide the configuration and executable properties of this product. Failure to properly secure these objects could lead to unauthorized access. This exposure may result in the compromise of the integrity and availability of the operating system environment, ACP, and customer data.",
|
|
704
|
+
"severity": "medium"
|
|
705
|
+
},
|
|
706
|
+
{
|
|
707
|
+
"id": "V-3331",
|
|
708
|
+
"title": "The ACP audit logs must be reviewed on a regular basis .",
|
|
709
|
+
"description": "Each ACP has the ability to produce audit records, based on specific security-related events. Audit Trail, Monitoring, Analysis and Reporting provides automated, continuous on-line monitoring and audit trail creation capability, to alert personnel of any unusual or inappropriate activity with potential IA implications. Failure to perform audit log analysis would allow for unusual or inappropriate activity to continue without review and appropriate actions taken.",
|
|
710
|
+
"severity": "medium"
|
|
711
|
+
},
|
|
712
|
+
{
|
|
713
|
+
"id": "V-33795",
|
|
714
|
+
"title": "Sensitive and critical system data sets exist on shared DASD.",
|
|
715
|
+
"description": "Any time a sensitive or critical system data set is allocated on a shared DASD device, it is critical to validate that it is properly protected on any additional systems that are sharing that device. Without proper review and adequate restrictions to access of these data sets on all systems sharing them, can lead to corruption, integrity and availability of the operating system, ACP, and customer data.",
|
|
716
|
+
"severity": "medium"
|
|
717
|
+
},
|
|
718
|
+
{
|
|
719
|
+
"id": "V-34",
|
|
720
|
+
"title": "System programs (e.g., exits, SVCs, etc.) must have approval of appropriate authority and/or documented correctly.",
|
|
721
|
+
"description": "Many vendor products and applications require or provide operating system exits, SVCs, I/O appendages, special PPT privileges, and APF authorization. Without proper review, approval and adequate documentation of these system programs, the integrity and availability of the operating system, ACP, and customer data are subject to compromise.",
|
|
722
|
+
"severity": "medium"
|
|
723
|
+
},
|
|
724
|
+
{
|
|
725
|
+
"id": "V-36",
|
|
726
|
+
"title": "Dynamic lists must be protected in accordance with proper security requirements.",
|
|
727
|
+
"description": "Dynamic lists provide a method of making z/OS system changes without interrupting the availability of the operating system. Failure to properly control access to these facilities could result in unauthorized personnel modifying sensitive z/OS lists. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.",
|
|
728
|
+
"severity": "high"
|
|
729
|
+
},
|
|
730
|
+
{
|
|
731
|
+
"id": "V-3716",
|
|
732
|
+
"title": "User accounts defined to the ACP do not uniquely identify system users.",
|
|
733
|
+
"description": "System users must be uniquely identified to the operating system. To accomplish this, each user must have an individual account defined to the ACP. If user accounts are not associated with specific individuals and are shared among multiple users, individual accountability is lost. This could hamper security audit activities and lead to unauthorized user access of system resources and customer data.\n. Scope of, ownership of and responsibility over users shall be based upon the specifics of appointment, role, responsibilities and level of authority. Such as a domain/system level IAO is responsible for the Domain/system level users, whereas normally a application user would be the responsibility of the DoD AIS application security team unless SLA indicates otherwise.",
|
|
734
|
+
"severity": "medium"
|
|
735
|
+
},
|
|
736
|
+
{
|
|
737
|
+
"id": "V-3895",
|
|
738
|
+
"title": "DFSMS control data sets must be protected in accordance with security requirements.",
|
|
739
|
+
"description": "DFSMS control data sets provide the configuration and operational characteristics of the system-managed storage environment. Failure to properly protect these data sets may result in unauthorized access. This exposure could compromise the availability and integrity of some system services and customer data.",
|
|
740
|
+
"severity": "medium"
|
|
741
|
+
},
|
|
742
|
+
{
|
|
743
|
+
"id": "V-3896",
|
|
744
|
+
"title": "SYS(x).Parmlib(IEFSSNxx) SMS configuration parameter settings are not properly specified.\n",
|
|
745
|
+
"description": "Configuration properties of DFSMS are specified in various members of the system parmlib concatenation (e.g., SYS1.PARMLIB). Statements within these PDS members provide the execution, operational, and configuration characteristics of the system-managed storage environment. Missing or inappropriate configuration values may result in undesirable operations and degraded security. This exposure could potentially compromise the availability and integrity of some system services and customer data.",
|
|
746
|
+
"severity": "low"
|
|
747
|
+
},
|
|
748
|
+
{
|
|
749
|
+
"id": "V-3897",
|
|
750
|
+
"title": "MVS data sets for the WebSphere Application Server are not protected in accordance with the proper security requirements.",
|
|
751
|
+
"description": "MVS data sets provide the configuration, operational, and executable properties of the WebSphere Application Server (WAS) environment. Failure to properly protect these data sets may lead to unauthorized access. This exposure could compromise the integrity and availability of system services, applications, and customer data.",
|
|
752
|
+
"severity": "medium"
|
|
753
|
+
},
|
|
754
|
+
{
|
|
755
|
+
"id": "V-3898",
|
|
756
|
+
"title": "HFS objects for the WebSphere Application Server are not protected in accordance with the proper security requirements.",
|
|
757
|
+
"description": "HFS directories and files provide the configuration, operational, and executable properties of the WebSphere Application Server (WAS) environment. Many of these objects are responsible for the security implementation of WAS. Failure to properly protect these directories and files may lead to unauthorized access. This exposure could potentially compromise the integrity and availability of system services, applications, and customer data.",
|
|
758
|
+
"severity": "medium"
|
|
759
|
+
},
|
|
760
|
+
{
|
|
761
|
+
"id": "V-3899",
|
|
762
|
+
"title": "The CBIND Resource Class for the WebSphere Application Server is not configured in accordance with security requirements.\n",
|
|
763
|
+
"description": "SAF resources provide the ability to control access to functions and services of the WebSphere Application Server (WAS) environment. Many of these resources provide operational and administrative support for WAS. Failure to properly protect these resources may lead to unauthorized access. This exposure could compromise the integrity and availability of application services and customer data.",
|
|
764
|
+
"severity": "medium"
|
|
765
|
+
},
|
|
766
|
+
{
|
|
767
|
+
"id": "V-3900",
|
|
768
|
+
"title": "Vendor-supplied user accounts for the WebSphere Application Server are defined to the ACP.",
|
|
769
|
+
"description": "Vendor-supplied user accounts are defined to the ACP with factory-set passwords during the installation of the WebSphere Application Server (WAS). These user accounts are common to all WAS environments and have access to restricted resources and functions. Failure to delete vendor-supplied user accounts from the ACP may lead to unauthorized access. This exposure could compromise the integrity and availability of system services, applications, and customer data.",
|
|
770
|
+
"severity": "high"
|
|
771
|
+
},
|
|
772
|
+
{
|
|
773
|
+
"id": "V-3901",
|
|
774
|
+
"title": "The WebSphere Application Server plug-in is not specified in accordance with the proper security requirements.",
|
|
775
|
+
"description": "Requests processed by the WebSphere Application Server (WAS) are dependent on directives configured in the HTTP server httpd.conf file. These directives specify critical files containing the WAS plug-in and WAS configuration. These files provide the operational and security characteristics of WAS. Failure to properly configure WAS-related directives could lead to undesirable operations and degraded security. This exposure may compromise the availability and integrity of applications and customer data.",
|
|
776
|
+
"severity": "medium"
|
|
777
|
+
},
|
|
778
|
+
{
|
|
779
|
+
"id": "V-3903",
|
|
780
|
+
"title": "User timeout parameter values for WebSphere MQ queue managers are not specified in accordance with security requirements.\n",
|
|
781
|
+
"description": "Users signed on to a WebSphere MQ queue manager could leave their terminals unattended for long periods of time. This may allow unauthorized individuals to gain access to WebSphere MQ resources and application data. This exposure could compromise the availability, integrity, and confidentiality of some system services and application data.",
|
|
782
|
+
"severity": "medium"
|
|
783
|
+
},
|
|
784
|
+
{
|
|
785
|
+
"id": "V-3904",
|
|
786
|
+
"title": "WebSphere MQ started tasks are not defined in accordance with the proper security requirements.",
|
|
787
|
+
"description": "Started tasks are used to execute WebSphere MQ queue manager services. Improperly defined WebSphere MQ started tasks may result in inappropriate access to application resources and the loss of accountability. This exposure could compromise the availability of some system services and application data.",
|
|
788
|
+
"severity": "medium"
|
|
789
|
+
},
|
|
790
|
+
{
|
|
791
|
+
"id": "V-3905",
|
|
792
|
+
"title": "WebSphere MQ all update and alter access to MQSeries/WebSphere MQ product and system data sets are not properly restricted ",
|
|
793
|
+
"description": "MVS data sets provide the configuration, operational, and executable properties of WebSphere MQ. Some data sets are responsible for the security implementation of WebSphere MQ. Failure to properly protect these data sets may lead to unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.",
|
|
794
|
+
"severity": "medium"
|
|
795
|
+
},
|
|
796
|
+
{
|
|
797
|
+
"id": "V-44",
|
|
798
|
+
"title": "CICS region logonid(s) must be defined and/or controlled in accordance with the security requirements.\n",
|
|
799
|
+
"description": "CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS region userids may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.\n\nThe region userid should be associated with a unique RACF userid. ",
|
|
800
|
+
"severity": "medium"
|
|
801
|
+
},
|
|
802
|
+
{
|
|
803
|
+
"id": "V-4850",
|
|
804
|
+
"title": "Allocate access to system user catalogs are not limited to system programmers only. ",
|
|
805
|
+
"description": "System catalogs are the basis for locating all files on the system. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
806
|
+
"severity": "medium"
|
|
807
|
+
},
|
|
808
|
+
{
|
|
809
|
+
"id": "V-54",
|
|
810
|
+
"title": "Surrogate users must be controlled in accordance with proper security requirements.",
|
|
811
|
+
"description": "Surrogate users have the ability to submit jobs on behalf of another user (the execution user) without specifying the execution user's password. Jobs submitted by surrogate users run with the identity of the execution user. Failure to properly control surrogate users could result in unauthorized personnel accessing sensitive resources. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.",
|
|
812
|
+
"severity": "medium"
|
|
813
|
+
},
|
|
814
|
+
{
|
|
815
|
+
"id": "V-5605",
|
|
816
|
+
"title": "Non-existent or inaccessible Link Pack Area (LPA) libraries.",
|
|
817
|
+
"description": " LPA libraries give a common access point for the general usage of modules. Many of the subsystems installed on a domain rely upon these modules for proper execution. If the list of libraries found in this LPA member is not properly maintained, the integrity of the operating environment is subject to compromise.\n",
|
|
818
|
+
"severity": "low"
|
|
819
|
+
},
|
|
820
|
+
{
|
|
821
|
+
"id": "V-5627",
|
|
822
|
+
"title": "The hosts identified by the NSINTERADDR statement will be properly protected.",
|
|
823
|
+
"description": "If the hosts identified by NSINTERADDR statement are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the host and the hosts' components. Therefore, they can interfere with the normal operations of the host. Improper control of hosts and the hosts' components could compromise network operations.",
|
|
824
|
+
"severity": "medium"
|
|
825
|
+
},
|
|
826
|
+
{
|
|
827
|
+
"id": "V-59477",
|
|
828
|
+
"title": "RACF exit ICHPWX01 must be installed and properly configured.",
|
|
829
|
+
"description": "Password complexity, or strength, is a measure of the effectiveness of a password in resisting guessing and brute-force attacks. Password complexity is one factor of several that determine how long it takes to crack a password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised. Use of a complex password helps to increase the time and resources required to compromise the password.\n\nThe RACF exit ICHPWX01 will allow for additional checks not available in RACF SETROPTS whenever a user selects a new password. Improper setting of any of these fields, individually or in combination with another, can result in weakened passwords and compromise the security of the processing environment.",
|
|
830
|
+
"severity": "medium"
|
|
831
|
+
},
|
|
832
|
+
{
|
|
833
|
+
"id": "V-64803",
|
|
834
|
+
"title": "The RACF System REXX IRRPWREX security data set must be properly protected.",
|
|
835
|
+
"description": "The RACF System REXX named IRRPWREX contains sensitive access control and password information for the operating system environment and system resources. Unauthorized access could result in the compromise of passwords, the operating system environment, ACP (Access Control Program), and customer data.",
|
|
836
|
+
"severity": "high"
|
|
837
|
+
},
|
|
838
|
+
{
|
|
839
|
+
"id": "V-65649",
|
|
840
|
+
"title": "NIST FIPS-validated cryptography must be used to protect passwords in the security database.",
|
|
841
|
+
"description": "Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Cryptographic modules must adhere to the higher standards approved by the federal government since this provides assurance they have been tested and validated.",
|
|
842
|
+
"severity": "high"
|
|
843
|
+
},
|
|
844
|
+
{
|
|
845
|
+
"id": "V-6898",
|
|
846
|
+
"title": "CICS regions are improperly protected to prevent unauthorized propagation of the region userid.",
|
|
847
|
+
"description": "CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.",
|
|
848
|
+
"severity": "medium"
|
|
849
|
+
},
|
|
850
|
+
{
|
|
851
|
+
"id": "V-6900",
|
|
852
|
+
"title": "All hardware components of the FEPs are not placed in secure locations where they cannot be stolen, damaged, or disturbed",
|
|
853
|
+
"description": "If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, the operator console, and the diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations.",
|
|
854
|
+
"severity": "medium"
|
|
855
|
+
},
|
|
856
|
+
{
|
|
857
|
+
"id": "V-6901",
|
|
858
|
+
"title": "Procedures are not in place to restrict access to FEP functions of the service subsystem from operator consoles (local and/or remote), and to restrict access to the diskette drive of the service subsystem.",
|
|
859
|
+
"description": "If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, the operator console, and the diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations.",
|
|
860
|
+
"severity": "medium"
|
|
861
|
+
},
|
|
862
|
+
{
|
|
863
|
+
"id": "V-6902",
|
|
864
|
+
"title": "A documented procedure is not available instructing how to load and dump the FEP NCP (Network Control Program).",
|
|
865
|
+
"description": "If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, the operator console, and the diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations.",
|
|
866
|
+
"severity": "medium"
|
|
867
|
+
},
|
|
868
|
+
{
|
|
869
|
+
"id": "V-6903",
|
|
870
|
+
"title": "An active log is not available to keep track of all hardware upgrades and software changes made to the FEP (Front End Processor).",
|
|
871
|
+
"description": "If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, the operator console, and the diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations.",
|
|
872
|
+
"severity": "medium"
|
|
873
|
+
},
|
|
874
|
+
{
|
|
875
|
+
"id": "V-6904",
|
|
876
|
+
"title": "NCP (Net Work Control Program) Data set access authorization does not restricts UPDATE and/or ALLOCATE access to appropriate personnel.",
|
|
877
|
+
"description": "If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, the operator console, and the diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations.",
|
|
878
|
+
"severity": "medium"
|
|
879
|
+
},
|
|
880
|
+
{
|
|
881
|
+
"id": "V-6905",
|
|
882
|
+
"title": "A password control is not in place to restrict access to the service subsystem via the operator consoles (local and/or remote) and a key-lock switch is not used to protect the modem supporting the remote console of the service subsystem.",
|
|
883
|
+
"description": "If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, the operator console, and the diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations.",
|
|
884
|
+
"severity": "medium"
|
|
885
|
+
},
|
|
886
|
+
{
|
|
887
|
+
"id": "V-6916",
|
|
888
|
+
"title": "RJE workstations and NJE nodes are not controlled in accordance with security requirements.",
|
|
889
|
+
"description": "JES2 RJE workstations and NJE nodes provide a method of sending and receiving data (e.g., jobs, job output, and commands) from remote locations. Failure to properly identify and control these remote facilities could result in unauthorized sources transmitting data to and from the operating system. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.",
|
|
890
|
+
"severity": "medium"
|
|
891
|
+
},
|
|
892
|
+
{
|
|
893
|
+
"id": "V-6918",
|
|
894
|
+
"title": "RJE workstations and NJE nodes are not controlled in accordance with STIG requirements.",
|
|
895
|
+
"description": "JES2 RJE workstations and NJE nodes provide a method of sending and receiving data (e.g., jobs, job output, and commands) from remote locations. Failure to properly identify and control these remote facilities could result in unauthorized sources transmitting data to and from the operating system. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.",
|
|
896
|
+
"severity": "medium"
|
|
897
|
+
},
|
|
898
|
+
{
|
|
899
|
+
"id": "V-6919",
|
|
900
|
+
"title": "JES2 input sources are not controlled in accordance with theh proper security requirements.",
|
|
901
|
+
"description": "JES2 input sources provide a variety of channels for job submission. Failure to properly control the use of these input sources could result in unauthorized submission of work into the operating system. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.",
|
|
902
|
+
"severity": "medium"
|
|
903
|
+
},
|
|
904
|
+
{
|
|
905
|
+
"id": "V-6920",
|
|
906
|
+
"title": "JES2 input sources must be properly controlled.",
|
|
907
|
+
"description": "JES2 input sources provide a variety of channels for job submission. Failure to properly control the use of these input sources could result in unauthorized submission of work into the operating system. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.",
|
|
908
|
+
"severity": "medium"
|
|
909
|
+
},
|
|
910
|
+
{
|
|
911
|
+
"id": "V-6921",
|
|
912
|
+
"title": "JES2 output devices are not controlled in accordance with the proper security requirements.",
|
|
913
|
+
"description": "JES2 output devices provide a variety of channels to which output can be processed. Failure to properly control these output devices could result in unauthorized personnel accessing output. This exposure may compromise the confidentiality of customer data.",
|
|
914
|
+
"severity": "medium"
|
|
915
|
+
},
|
|
916
|
+
{
|
|
917
|
+
"id": "V-6922",
|
|
918
|
+
"title": "JES2 output devices must be properly controlled for Classified Systems.",
|
|
919
|
+
"description": "JES2 output devices provide a variety of channels to which output can be processed. Failure to properly control these output devices could result in unauthorized personnel accessing output. This exposure may compromise the confidentiality of customer data on a classified System..",
|
|
920
|
+
"severity": "medium"
|
|
921
|
+
},
|
|
922
|
+
{
|
|
923
|
+
"id": "V-69223",
|
|
924
|
+
"title": "All digital certificates in use must have a valid path to a trusted Certification authority.\n\n",
|
|
925
|
+
"description": "The origin of a certificate, the Certificate Authority (i.e., CA), is crucial in determining if the certificate should be trusted. An approved CA establishes grounds for confidence at both ends of communications sessions in ongoing identities of other parties and in the validity of information transmitted.\n\n",
|
|
926
|
+
"severity": "medium"
|
|
927
|
+
},
|
|
928
|
+
{
|
|
929
|
+
"id": "V-69225",
|
|
930
|
+
"title": "Expired Digital Certificates must not be used.",
|
|
931
|
+
"description": "The longer and more often a key is used, the more susceptible it is to loss or discovery. This weakens the assurance provided to a relying Party that the unique binding between a key and its named subscriber is valid. Therefore, it is important that certificates are periodically refreshed. This is in accordance with DoD requirement. Expired Certificate must not be in use.",
|
|
932
|
+
"severity": "medium"
|
|
933
|
+
},
|
|
934
|
+
{
|
|
935
|
+
"id": "V-69227",
|
|
936
|
+
"title": "Certificate Name Filtering must be implemented with appropriate authorization and documentation.",
|
|
937
|
+
"description": "Certificate name filtering is a facility that allows multiple certificates to be mapped to a single ACP userid. Rather than matching a certificate stored in the ACP to determine the userid, criteria rules are used. Depending on the filter criteria, a large number of client certificates could be mapped to a single userid. Failure to properly control the use of certificate name filtering could result in the loss of individual identity and accountability.",
|
|
938
|
+
"severity": "medium"
|
|
939
|
+
},
|
|
940
|
+
{
|
|
941
|
+
"id": "V-69229",
|
|
942
|
+
"title": "The SSH daemon must be configured to only use the SSHv2 protocol.\n\n",
|
|
943
|
+
"description": "SSHv1 is not a DoD-approved protocol and has many well-known vulnerability exploits. Exploits of the SSH daemon could provide immediate root access to the system.",
|
|
944
|
+
"severity": "high"
|
|
945
|
+
},
|
|
946
|
+
{
|
|
947
|
+
"id": "V-6923",
|
|
948
|
+
"title": "JESSPOOL resources are not protected in accordance with security requirements.",
|
|
949
|
+
"description": "JES2 spool resources include all SYSOUT, SYSLOG, JESTRACE, and JESNEWS data sets. Failure to properly control JES2 spool resources could result in unauthorized personnel accessing job output, system activity logs, and trace data containing userid and password information. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.",
|
|
950
|
+
"severity": "medium"
|
|
951
|
+
},
|
|
952
|
+
{
|
|
953
|
+
"id": "V-69231",
|
|
954
|
+
"title": "The SSH daemon must be configured to use a FIPS 140-2 compliant cryptographic algorithm.",
|
|
955
|
+
"description": "Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Cryptographic modules must adhere to the higher standards approved by the federal government since this provides assurance they have been tested and validated.",
|
|
956
|
+
"severity": "high"
|
|
957
|
+
},
|
|
958
|
+
{
|
|
959
|
+
"id": "V-69233",
|
|
960
|
+
"title": "The SSH daemon must be configured with the Department of Defense (DoD) logon banner.",
|
|
961
|
+
"description": "Failure to display the DoD logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.",
|
|
962
|
+
"severity": "medium"
|
|
963
|
+
},
|
|
964
|
+
{
|
|
965
|
+
"id": "V-69235",
|
|
966
|
+
"title": "SMF recording options for the SSH daemon must be configured to write SMF records for all eligible events. ",
|
|
967
|
+
"description": "SMF data collection is the basic unit of tracking of all system functions and actions. Included in this tracking data are the audit trails from each of the ACPs. If the control options for the recording of this tracking are not properly maintained, then accountability cannot be monitored, and its use in the execution of a contingency plan could be compromised.",
|
|
968
|
+
"severity": "medium"
|
|
969
|
+
},
|
|
970
|
+
{
|
|
971
|
+
"id": "V-69237",
|
|
972
|
+
"title": "The SSH daemon must be configured to use SAF keyrings for key storage.",
|
|
973
|
+
"description": "The use of SAF Key Rings for key storage enforces organizational access control policies and assures the protection of cryptographic keys in storage. ",
|
|
974
|
+
"severity": "medium"
|
|
975
|
+
},
|
|
976
|
+
{
|
|
977
|
+
"id": "V-6924",
|
|
978
|
+
"title": "JESNEWS rewsources are not protected in accordance with security requirements.",
|
|
979
|
+
"description": "JES2 spool resources include all SYSOUT, SYSLOG, JESTRACE, and JESNEWS data sets. Failure to properly control JES2 spool resources could result in unauthorized personnel accessing job output, system activity logs, and trace data containing userid and password information. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.",
|
|
980
|
+
"severity": "medium"
|
|
981
|
+
},
|
|
982
|
+
{
|
|
983
|
+
"id": "V-6925",
|
|
984
|
+
"title": "JESTRACE and/or SYSLOG resources are not protected in accordance with security requirements.\n",
|
|
985
|
+
"description": "JES2 spool resources include all SYSOUT, SYSLOG, JESTRACE, and JESNEWS data sets. Failure to properly control JES2 spool resources could result in unauthorized personnel accessing job output, system activity logs, and trace data containing userid and password information. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.",
|
|
986
|
+
"severity": "medium"
|
|
987
|
+
},
|
|
988
|
+
{
|
|
989
|
+
"id": "V-6926",
|
|
990
|
+
"title": "JES2 spool resources will be controlled in accordance with security requirements.",
|
|
991
|
+
"description": "JES2 spool resources include all SYSOUT, SYSLOG, JESTRACE, and JESNEWS data sets. Failure to properly control JES2 spool resources could result in unauthorized personnel accessing job output, system activity logs, and trace data containing userid and password information. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.",
|
|
992
|
+
"severity": "medium"
|
|
993
|
+
},
|
|
994
|
+
{
|
|
995
|
+
"id": "V-6928",
|
|
996
|
+
"title": "JES2 system commands are not protected in accordance with security requirements.",
|
|
997
|
+
"description": "JES2 system commands are used to control JES2 resources and the operating system environment. Failure to properly control access to JES2 system commands could result in unauthorized personnel issuing sensitive JES2 commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.",
|
|
998
|
+
"severity": "medium"
|
|
999
|
+
},
|
|
1000
|
+
{
|
|
1001
|
+
"id": "V-6933",
|
|
1002
|
+
"title": "SMS Program Resources must be properly defined and protected.",
|
|
1003
|
+
"description": "DFSMS provides data, storage, program, and device management functions for the operating system. Some DFSMS storage administration functions allow a user to obtain a privileged status and effectively bypass all ACP data set and volume controls. Failure to properly protect DFSMS resources may result in unauthorized access. This exposure could compromise the availability and integrity of the operating system environment, system services, and customer data.",
|
|
1004
|
+
"severity": "medium"
|
|
1005
|
+
},
|
|
1006
|
+
{
|
|
1007
|
+
"id": "V-6936",
|
|
1008
|
+
"title": "DFSMS control data sets are not properly protected.",
|
|
1009
|
+
"description": "DFSMS control data sets provide the configuration and operational characteristics of the system-managed storage environment. Failure to properly protect these data sets may result in unauthorized access. This exposure could compromise the availability and integrity of some system services and customer data.",
|
|
1010
|
+
"severity": "medium"
|
|
1011
|
+
},
|
|
1012
|
+
{
|
|
1013
|
+
"id": "V-6937",
|
|
1014
|
+
"title": "SYS(x).PARMLIB(IGDSMSxx), SMS parameter settings are not properly specified.\n",
|
|
1015
|
+
"description": "Configuration properties of DFSMS are specified in various members of the system parmlib concatenation (e.g., SYS1.PARMLIB). Statements within these PDS members provide the execution, operational, and configuration characteristics of the system-managed storage environment. Missing or inappropriate configuration values may result in undesirable operations and degraded security. This exposure could potentially compromise the availability and integrity of some system services and customer data.",
|
|
1016
|
+
"severity": "medium"
|
|
1017
|
+
},
|
|
1018
|
+
{
|
|
1019
|
+
"id": "V-6943",
|
|
1020
|
+
"title": "DFSMS-related RACF classes are not active.",
|
|
1021
|
+
"description": "DFSMS provides data, storage, program, and device management functions for the operating system. Some DFSMS storage administration functions allow a user to obtain a privileged status and effectively bypass all ACP data set and volume controls. Failure to properly protect DFSMS resources may result in unauthorized access. This exposure could compromise the availability and integrity of the operating system environment, system services, and customer data.",
|
|
1022
|
+
"severity": "medium"
|
|
1023
|
+
},
|
|
1024
|
+
{
|
|
1025
|
+
"id": "V-6944",
|
|
1026
|
+
"title": "z/OS UNIX OMVS parameters in PARMLIB are not properly specified.",
|
|
1027
|
+
"description": "Parameter settings in PARMLIB and /etc specify values for z/OS UNIX security controls. The parameters impact HFS data access and operating system services. Undesirable values can allow users to gain inappropriate privileges that could impact data integrity or the availability of some system services.",
|
|
1028
|
+
"severity": "medium"
|
|
1029
|
+
},
|
|
1030
|
+
{
|
|
1031
|
+
"id": "V-6945",
|
|
1032
|
+
"title": "z/OS UNIX BPXPRMxx security parameters in PARMLIB are not properly specified.",
|
|
1033
|
+
"description": "Parameter settings in PARMLIB and /etc specify values for z/OS UNIX security controls. The parameters impact HFS data access and operating system services. Undesirable values can allow users to gain inappropriate privileges that could impact data integrity or the availability of some system services.",
|
|
1034
|
+
"severity": "medium"
|
|
1035
|
+
},
|
|
1036
|
+
{
|
|
1037
|
+
"id": "V-6946",
|
|
1038
|
+
"title": "z/OS UNIX HFS MapName files security parameters are not properly specified.",
|
|
1039
|
+
"description": "Parameter settings in PARMLIB and /etc specify values for z/OS UNIX security controls. The parameters impact HFS data access and operating system services. Undesirable values can allow users to gain inappropriate privileges that could impact data integrity or the availability of some system services.",
|
|
1040
|
+
"severity": "medium"
|
|
1041
|
+
},
|
|
1042
|
+
{
|
|
1043
|
+
"id": "V-6947",
|
|
1044
|
+
"title": "z/OS UNIX security parameters for restricted network service(s) in /etc/inetd.conf are not properly specified.",
|
|
1045
|
+
"description": "Parameter settings in PARMLIB and /etc specify values for z/OS UNIX security controls. The parameters impact HFS data access and operating system services. Undesirable values can allow users to gain inappropriate privileges that could impact data integrity or the availability of some system services.",
|
|
1046
|
+
"severity": "medium"
|
|
1047
|
+
},
|
|
1048
|
+
{
|
|
1049
|
+
"id": "V-6949",
|
|
1050
|
+
"title": "The VTAM USSTAB definitions are being used for unsecured terminals",
|
|
1051
|
+
"description": "VTAM options and definitions are used to define VTAM operational capabilities. They must be strictly controlled. Unauthorized users could override or change start options or network definitions. Failure to properly control VTAM resources could potentially compromise the network operations.",
|
|
1052
|
+
"severity": "medium"
|
|
1053
|
+
},
|
|
1054
|
+
{
|
|
1055
|
+
"id": "V-6956",
|
|
1056
|
+
"title": "The System datasets used to support the VTAM network are not properly secured.",
|
|
1057
|
+
"description": "Ensure that RACF data set rules for all VTAM system data sets restrict access to only network systems programming staff. These data sets include libraries containing VTAM load modules and exit routines, and VTAM start options and definition statements.\n\nFailure to properly control VTAM datasets could potentially compromise the network operations.\n",
|
|
1058
|
+
"severity": "medium"
|
|
1059
|
+
},
|
|
1060
|
+
{
|
|
1061
|
+
"id": "V-6958",
|
|
1062
|
+
"title": "WebSphere MQ channel security must be implemented in accordance with security requirements.",
|
|
1063
|
+
"description": "WebSphere MQ Channel security can be configured to provide authentication, message privacy, and message integrity between queue managers. Secure Sockets Layer (SSL) uses encryption techniques, digital signatures and digital certificates to provide message privacy, message integrity and mutual authentication between clients and servers.\n\nFailure to properly secure a WebSphere MQ channel may lead to unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of some system services, applications, and customer data.",
|
|
1064
|
+
"severity": "high"
|
|
1065
|
+
},
|
|
1066
|
+
{
|
|
1067
|
+
"id": "V-6959",
|
|
1068
|
+
"title": "WebSphere MQ resource classes are not properly actived for security checking by the ACP.\n",
|
|
1069
|
+
"description": "WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to ensure the classes have been made ACTIVE under RACF will prevent RACF from enforcing security rules. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.",
|
|
1070
|
+
"severity": "medium"
|
|
1071
|
+
},
|
|
1072
|
+
{
|
|
1073
|
+
"id": "V-6960",
|
|
1074
|
+
"title": "WebSphere MQ \"switch\" profiles are improperly defined to the MQADMIN class.",
|
|
1075
|
+
"description": "WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.",
|
|
1076
|
+
"severity": "high"
|
|
1077
|
+
},
|
|
1078
|
+
{
|
|
1079
|
+
"id": "V-6961",
|
|
1080
|
+
"title": "z/OS UNIX security parameters in etc/profile are not properly specified.",
|
|
1081
|
+
"description": "Parameter settings in PARMLIB and /etc specify values for z/OS UNIX security controls. The parameters impact HFS data access and operating system services. Undesirable values can allow users to gain inappropriate privileges that could impact data integrity or the availability of some system services.",
|
|
1082
|
+
"severity": "medium"
|
|
1083
|
+
},
|
|
1084
|
+
{
|
|
1085
|
+
"id": "V-6962",
|
|
1086
|
+
"title": "WebSphere MQ MQCONN Class (Connection) resource definitions are not protected in accordance with security.\n",
|
|
1087
|
+
"description": "WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.",
|
|
1088
|
+
"severity": "medium"
|
|
1089
|
+
},
|
|
1090
|
+
{
|
|
1091
|
+
"id": "V-6963",
|
|
1092
|
+
"title": "z/OS UNIX security parameters in /etc/rc not properly specified.",
|
|
1093
|
+
"description": "Parameter settings in PARMLIB and /etc specify values for z/OS UNIX security controls. The parameters impact HFS data access and operating system services. Undesirable values can allow users to gain inappropriate privileges that could impact data integrity or the availability of some system services.",
|
|
1094
|
+
"severity": "medium"
|
|
1095
|
+
},
|
|
1096
|
+
{
|
|
1097
|
+
"id": "V-6964",
|
|
1098
|
+
"title": "WebSphere MQ dead letter and alias dead letter queues are not properly defined.",
|
|
1099
|
+
"description": "WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.",
|
|
1100
|
+
"severity": "medium"
|
|
1101
|
+
},
|
|
1102
|
+
{
|
|
1103
|
+
"id": "V-6965",
|
|
1104
|
+
"title": "WebSphere MQ MQQUEUE (Queue) resource profiles defined to the MQQUEUE class are not protected in accordance with security requirements.\n",
|
|
1105
|
+
"description": "WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.",
|
|
1106
|
+
"severity": "medium"
|
|
1107
|
+
},
|
|
1108
|
+
{
|
|
1109
|
+
"id": "V-6966",
|
|
1110
|
+
"title": "WebSphere MQ Process resource profiles defined in the MQPROC Class are not protected in accordance with security requirements.\n\n",
|
|
1111
|
+
"description": "WebSphere MQ Process resources allow for the control of processes. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.",
|
|
1112
|
+
"severity": "medium"
|
|
1113
|
+
},
|
|
1114
|
+
{
|
|
1115
|
+
"id": "V-6967",
|
|
1116
|
+
"title": "WebSphere MQ Namelist resource profiles defined in the MQNLIST Class are not protected in accordance with security requirements.\n",
|
|
1117
|
+
"description": "WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.",
|
|
1118
|
+
"severity": "medium"
|
|
1119
|
+
},
|
|
1120
|
+
{
|
|
1121
|
+
"id": "V-6968",
|
|
1122
|
+
"title": "BPX resource(s)s is(are) not protected in accordance with security requirements.",
|
|
1123
|
+
"description": "z/OS UNIX ACP-defined resources consist of sensitive capabilities including SUPERUSER, daemon, and numerous file manipulation privileges. Missing or inaccurate protection of these resources could allow a user to access sensitive data, modify or delete data and operating system controls, or issue commands that could negatively impact system availability.\n",
|
|
1124
|
+
"severity": "medium"
|
|
1125
|
+
},
|
|
1126
|
+
{
|
|
1127
|
+
"id": "V-6969",
|
|
1128
|
+
"title": "WebSphere MQ Alternate User resources defined to MQADMIN resource class are not protected in accordance with security requirements.\n",
|
|
1129
|
+
"description": "WebSphere MQ resources allow for the control of administrator functions, connections, commands, queues, processes, and namelists. Some resources provide the ability to disable or bypass security checking. Failure to properly protect WebSphere MQ resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.",
|
|
1130
|
+
"severity": "medium"
|
|
1131
|
+
},
|
|
1132
|
+
{
|
|
1133
|
+
"id": "V-6970",
|
|
1134
|
+
"title": "z/OS UNIX resources must be protected in accordance with security requirements.",
|
|
1135
|
+
"description": "z/OS UNIX ACP-defined resources consist of sensitive capabilities including SUPERUSER, daemon, and numerous file manipulation privileges. Missing or inaccurate protection of these resources could allow a user to access sensitive data, modify or delete data and operating system controls, or issue commands that could negatively impact system availability.",
|
|
1136
|
+
"severity": "high"
|
|
1137
|
+
},
|
|
1138
|
+
{
|
|
1139
|
+
"id": "V-6971",
|
|
1140
|
+
"title": "WebSphere MQ context resources defined to the MQADMIN resource class are not protected in accordance with security requirements.",
|
|
1141
|
+
"description": "Context security validates whether a userid has authority to pass or set identity and/or origin data\nfor a message. Context security will be active to avoid security exposure. \n\nThis exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.\n",
|
|
1142
|
+
"severity": "medium"
|
|
1143
|
+
},
|
|
1144
|
+
{
|
|
1145
|
+
"id": "V-6972",
|
|
1146
|
+
"title": "z/OS UNIX SUPERUSER resource must be protected in accordance with guidelines.\n",
|
|
1147
|
+
"description": "z/OS UNIX ACP-defined resources consist of sensitive capabilities including SUPERUSER, daemon, and numerous file manipulation privileges. Missing or inaccurate protection of these resources could allow a user to access sensitive data, modify or delete data and operating system controls, or issue commands that could negatively impact system availability.",
|
|
1148
|
+
"severity": "high"
|
|
1149
|
+
},
|
|
1150
|
+
{
|
|
1151
|
+
"id": "V-6973",
|
|
1152
|
+
"title": "WebSphere MQ command resources defined to MQCMDS resource class are not protected in accordance with security requirements.",
|
|
1153
|
+
"description": "WebSphere MQ resources allow for the control of commands. Failure to properly protect WebSphere MQ Command resources may result in unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of system services, applications, and customer data.\n",
|
|
1154
|
+
"severity": "medium"
|
|
1155
|
+
},
|
|
1156
|
+
{
|
|
1157
|
+
"id": "V-6974",
|
|
1158
|
+
"title": "z/OS UNIX MVS data sets or HFS objects are not properly protected.",
|
|
1159
|
+
"description": "For the z/OS UNIX environment, there are MVS data sets that contain operating system components, MVS data sets that contain HFS file systems with operating system components, and MVS data sets that contain HFS file systems with application system and user data. All of these MVS data sets require definitions in the ACP to enforce desired access controls. In addition, the UNIX permission bits must be properly set on the HFS directories and files to enforce desired access controls.",
|
|
1160
|
+
"severity": "medium"
|
|
1161
|
+
},
|
|
1162
|
+
{
|
|
1163
|
+
"id": "V-6975",
|
|
1164
|
+
"title": "WebSphere MQ RESLEVEL resources in the MQADMIN resource class are not protected in accordance with security requirements. ",
|
|
1165
|
+
"description": "RESLEVEL security profiles control the number of userids checked for API-resource security.\nRESLEVEL is a powerful option that can cause the bypassing of all security checks.\nRESLEVEL security will not be implemented. \n",
|
|
1166
|
+
"severity": "medium"
|
|
1167
|
+
},
|
|
1168
|
+
{
|
|
1169
|
+
"id": "V-6976",
|
|
1170
|
+
"title": "z/OS UNIX MVS data sets WITH z/OS UNIX COMPONENTS are not properly protected",
|
|
1171
|
+
"description": "For the z/OS UNIX environment, there are MVS data sets that contain operating system components, MVS data sets that contain HFS file systems with operating system components, and MVS data sets that contain HFS file systems with application system and user data. All of these MVS data sets require definitions in the ACP to enforce desired access controls. In addition, the UNIX permission bits must be properly set on the HFS directories and files to enforce desired access controls.",
|
|
1172
|
+
"severity": "medium"
|
|
1173
|
+
},
|
|
1174
|
+
{
|
|
1175
|
+
"id": "V-6977",
|
|
1176
|
+
"title": "z/OS UNIX MVS data sets used as step libraries in /etc/steplib are not properly protected",
|
|
1177
|
+
"description": "For the z/OS UNIX environment, there are MVS data sets that contain operating system components, MVS data sets that contain HFS file systems with operating system components, and MVS data sets that contain HFS file systems with application system and user data. All of these MVS data sets require definitions in the ACP to enforce desired access controls. In addition, the UNIX permission bits must be properly set on the HFS directories and files to enforce desired access controls.",
|
|
1178
|
+
"severity": "medium"
|
|
1179
|
+
},
|
|
1180
|
+
{
|
|
1181
|
+
"id": "V-6978",
|
|
1182
|
+
"title": "z/OS UNIX HFS permission bits and audit bits for each directory will be properly protected or specified.",
|
|
1183
|
+
"description": "For the z/OS UNIX environment, there are MVS data sets that contain operating system components, MVS data sets that contain HFS file systems with operating system components, and MVS data sets that contain HFS file systems with application system and user data. All of these MVS data sets require definitions in the ACP to enforce desired access controls. In addition, the UNIX permission bits must be properly set on the HFS directories and files to enforce desired access controls.",
|
|
1184
|
+
"severity": "medium"
|
|
1185
|
+
},
|
|
1186
|
+
{
|
|
1187
|
+
"id": "V-6979",
|
|
1188
|
+
"title": "z/OS UNIX SYSTEM FILE SECURITY SETTINGS will be properly protected or specified.",
|
|
1189
|
+
"description": "For the z/OS UNIX environment, there are MVS data sets that contain operating system components, MVS data sets that contain HFS file systems with operating system components, and MVS data sets that contain HFS file systems with application system and user data. All of these MVS data sets require definitions in the ACP to enforce desired access controls. In addition, the UNIX permission bits must be properly set on the HFS directories and files to enforce desired access controls.",
|
|
1190
|
+
"severity": "medium"
|
|
1191
|
+
},
|
|
1192
|
+
{
|
|
1193
|
+
"id": "V-6980",
|
|
1194
|
+
"title": "WebSphere MQ channel security is not implemented in accordance with security requirements.",
|
|
1195
|
+
"description": "WebSphere MQ channel security can be configured to provide authentication, message privacy, and message integrity between queue managers. WebSphere MQ channels use SSL encryption techniques, digital signatures and digital certificates to provide message privacy, message integrity and mutual authentication between clients and servers.\n\nFailure to properly secure a WebSphere MQ channel may lead to unauthorized access. This exposure could compromise the availability, integrity, and confidentiality of some system services, applications, and customer data.",
|
|
1196
|
+
"severity": "medium"
|
|
1197
|
+
},
|
|
1198
|
+
{
|
|
1199
|
+
"id": "V-6981",
|
|
1200
|
+
"title": "z/OS UNIX MVS HFS directory(s) with \"other\" write permission bit set are not properly defined.",
|
|
1201
|
+
"description": "For the z/OS UNIX environment, there are MVS data sets that contain operating system components, MVS data sets that contain HFS file systems with operating system components, and MVS data sets that contain HFS file systems with application system and user data. All of these MVS data sets require definitions in the ACP to enforce desired access controls. In addition, the UNIX permission bits must be properly set on the HFS directories and files to enforce desired access controls.",
|
|
1202
|
+
"severity": "medium"
|
|
1203
|
+
},
|
|
1204
|
+
{
|
|
1205
|
+
"id": "V-6985",
|
|
1206
|
+
"title": "Attributes of z/OS UNIX user accounts are not defined properly",
|
|
1207
|
+
"description": "User identifiers (ACF2 logonids, RACF userids, and Top Secret ACIDs), groups, and started tasks that use z/OS UNIX facilities are defined to an ACP with attributes including UID and GID. If these attributes are not correctly defined, data access or command privilege controls could be compromised.",
|
|
1208
|
+
"severity": "medium"
|
|
1209
|
+
},
|
|
1210
|
+
{
|
|
1211
|
+
"id": "V-6986",
|
|
1212
|
+
"title": "z/OS UNIX each group is not defined with a unique GID.",
|
|
1213
|
+
"description": "User identifiers (ACF2 logonids, RACF userids, and Top Secret ACIDs), groups, and started tasks that use z/OS UNIX facilities are defined to an ACP with attributes including UID and GID. If these attributes are not correctly defined, data access or command privilege controls could be compromised.",
|
|
1214
|
+
"severity": "medium"
|
|
1215
|
+
},
|
|
1216
|
+
{
|
|
1217
|
+
"id": "V-6987",
|
|
1218
|
+
"title": "The user account for the z/OS UNIX kernel (OMVS) is not properly defined to the security database.",
|
|
1219
|
+
"description": "User identifiers (ACF2 logonids, RACF userids, and Top Secret ACIDs), groups, and started tasks that use z/OS UNIX facilities are defined to an ACP with attributes including UID and GID. If these attributes are not correctly defined, data access or command privilege controls could be compromised.",
|
|
1220
|
+
"severity": "medium"
|
|
1221
|
+
},
|
|
1222
|
+
{
|
|
1223
|
+
"id": "V-6988",
|
|
1224
|
+
"title": "The user account for the z/OS UNIX SUPERSUSER userid must be properly defined.",
|
|
1225
|
+
"description": "User identifiers (ACF2 logonids, RACF userids, and Top Secret ACIDs), groups, and started tasks that use z/OS UNIX facilities are defined to an ACP with attributes including UID and GID. If these attributes are not correctly defined, data access or command privilege controls could be compromised.",
|
|
1226
|
+
"severity": "medium"
|
|
1227
|
+
},
|
|
1228
|
+
{
|
|
1229
|
+
"id": "V-6989",
|
|
1230
|
+
"title": "The user account for the z/OS UNIX (RMFGAT) must be properly defined.",
|
|
1231
|
+
"description": "User identifiers (ACF2 logonids, RACF userids, and Top Secret ACIDs), groups, and started tasks that use z/OS UNIX facilities are defined to an ACP with attributes including UID and GID. If these attributes are not correctly defined, data access or command privilege controls could be compromised.",
|
|
1232
|
+
"severity": "medium"
|
|
1233
|
+
},
|
|
1234
|
+
{
|
|
1235
|
+
"id": "V-6991",
|
|
1236
|
+
"title": "UID(0) is improperly assigned.",
|
|
1237
|
+
"description": "User identifiers (ACF2 logonids, RACF userids, and Top Secret ACIDs), groups, and started tasks that use z/OS UNIX facilities are defined to an ACP with attributes including UID and GID. If these attributes are not correctly defined, data access or command privilege controls could be compromised.",
|
|
1238
|
+
"severity": "high"
|
|
1239
|
+
},
|
|
1240
|
+
{
|
|
1241
|
+
"id": "V-6992",
|
|
1242
|
+
"title": "z/OS UNIX user accounts are not properly defined.",
|
|
1243
|
+
"description": "User identifiers (ACF2 logonids, RACF userids, and Top Secret ACIDs), groups, and started tasks that use z/OS UNIX facilities are defined to an ACP with attributes including UID and GID. If these attributes are not correctly defined, data access or command privilege controls could be compromised.",
|
|
1244
|
+
"severity": "medium"
|
|
1245
|
+
},
|
|
1246
|
+
{
|
|
1247
|
+
"id": "V-6997",
|
|
1248
|
+
"title": "The z/OS Default profiles must not be defined in the corresponding FACILITY Class Profile for classified systems.",
|
|
1249
|
+
"description": "The RACF FACILITY Class BPX. UNIQUE.USER profile contains the userid or the userid/group ID of the default profiles to be used for a user without a z/OS UNIX profile (i.e., OMVS Segment). In classified system user access will not be determined by default.",
|
|
1250
|
+
"severity": "medium"
|
|
1251
|
+
},
|
|
1252
|
+
{
|
|
1253
|
+
"id": "V-6998",
|
|
1254
|
+
"title": "The RACF Classes required to properly security the z/OS UNIX environment are not ACTIVE.",
|
|
1255
|
+
"description": "The FACILITY, SURROGAT, and UNIXPRIV Class support profiles used to secure the z/OS UNIX (OMVS) environment. Without these classes being in an ACTIVE status, system integrity can be compromised.",
|
|
1256
|
+
"severity": "medium"
|
|
1257
|
+
},
|
|
1258
|
+
{
|
|
1259
|
+
"id": "V-6999",
|
|
1260
|
+
"title": "RACF Classes required to support z/OS UNIX security are not properly implemented with the SETROPTS RACLIST command.",
|
|
1261
|
+
"description": "RACF provides the ability to load certain class profiles into memory for better performance thru the use of the SETR RACLIST command. For some classes, RACLISTing is strongly recommended and should be implemented. By not following vendor recommendations, unpredictable results could occur that compromise the integrity of the z/OS system.",
|
|
1262
|
+
"severity": "medium"
|
|
1263
|
+
},
|
|
1264
|
+
{
|
|
1265
|
+
"id": "V-7050",
|
|
1266
|
+
"title": "Attributes of z/OS UNIX user accounts used for account modeling must be defined in accordance with security requirements. \n",
|
|
1267
|
+
"description": "RACF userids that use z/OS UNIX must be properly configured. If these attributes are not correctly defined, data access or command privilege controls could be compromised.",
|
|
1268
|
+
"severity": "medium"
|
|
1269
|
+
},
|
|
1270
|
+
{
|
|
1271
|
+
"id": "V-7119",
|
|
1272
|
+
"title": "CICS default logonid(s) must be defined and/or controlled in accordance with the security requirements.",
|
|
1273
|
+
"description": "CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. An improperly defined or controlled CICS default userid may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.",
|
|
1274
|
+
"severity": "medium"
|
|
1275
|
+
},
|
|
1276
|
+
{
|
|
1277
|
+
"id": "V-7120",
|
|
1278
|
+
"title": "CICS logonid(s) do not have time-out limit set to 15 minutes.\n",
|
|
1279
|
+
"description": "CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS region userids may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.\n\nRACF provides the PROPCNTL class to prevent userids such as the CICS region userid from being propogated/used by unauthorized userids.",
|
|
1280
|
+
"severity": "medium"
|
|
1281
|
+
},
|
|
1282
|
+
{
|
|
1283
|
+
"id": "V-71203",
|
|
1284
|
+
"title": "The SETROPTS LOGOPTIONS must be properly configured.\n\n\n",
|
|
1285
|
+
"description": "Audit records are central to after-the-fact investigations of security incidents. Every effort should be taken to collect as much information as productively feasible for these investigative processes. The SETROPTS LOGOPTIONS option serves as a default auditing requirement. Auditing ‘Failures’ as a minimum will assure a base level of information is available for investigations. ",
|
|
1286
|
+
"severity": "low"
|
|
1287
|
+
},
|
|
1288
|
+
{
|
|
1289
|
+
"id": "V-71223",
|
|
1290
|
+
"title": "Libraries included in the system REXXLIB concatenation must be properly protected. ",
|
|
1291
|
+
"description": "The libraries included in the system REXXLIB concatenation can contain program modules which possess a significant level of security bypass capability. Unauthorized access could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
1292
|
+
"severity": "high"
|
|
1293
|
+
},
|
|
1294
|
+
{
|
|
1295
|
+
"id": "V-7482",
|
|
1296
|
+
"title": "z/OS system commands must be properly protected.",
|
|
1297
|
+
"description": "z/OS system commands provide a method of controlling the operating environment. Failure to properly control access to z/OS system commands could result in unauthorized personnel issuing sensitive system commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.\n",
|
|
1298
|
+
"severity": "medium"
|
|
1299
|
+
},
|
|
1300
|
+
{
|
|
1301
|
+
"id": "V-7485",
|
|
1302
|
+
"title": "CONSOLxx members must be properly configured.",
|
|
1303
|
+
"description": "MCS consoles can be used to issue operator commands. Failure to properly control access to MCS consoles could result in unauthorized personnel issuing sensitive operator commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.",
|
|
1304
|
+
"severity": "medium"
|
|
1305
|
+
},
|
|
1306
|
+
{
|
|
1307
|
+
"id": "V-7486",
|
|
1308
|
+
"title": "MCS console userid(s) will be properly protected.",
|
|
1309
|
+
"description": "MCS consoles can be used to issue operator commands. Failure to properly control access to MCS consoles could result in unauthorized personnel issuing sensitive operator commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.",
|
|
1310
|
+
"severity": "medium"
|
|
1311
|
+
},
|
|
1312
|
+
{
|
|
1313
|
+
"id": "V-7487",
|
|
1314
|
+
"title": "MCS consoles access authorization(s) for CONSOLE resource(s) must be properly protected. ",
|
|
1315
|
+
"description": "MCS consoles can be used to issue operator commands. Failure to properly control access to MCS consoles could result in unauthorized personnel issuing sensitive operator commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.",
|
|
1316
|
+
"severity": "medium"
|
|
1317
|
+
},
|
|
1318
|
+
{
|
|
1319
|
+
"id": "V-7488",
|
|
1320
|
+
"title": "Users that have access to the CONSOLE resource in the TSOAUTH resource class are not properly defined.\n",
|
|
1321
|
+
"description": "MCS consoles can be used to issue operator commands. Failure to properly control access to MCS consoles could result in unauthorized personnel issuing sensitive operator commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.",
|
|
1322
|
+
"severity": "medium"
|
|
1323
|
+
},
|
|
1324
|
+
{
|
|
1325
|
+
"id": "V-7490",
|
|
1326
|
+
"title": "FACILITY resource class is inactive.",
|
|
1327
|
+
"description": "IBM Provides the FACILITY Class for use in protecting a variety of features/functions/products both IBM and third party. The FACILITY Class is not dedicated to any one specific use and is intended as a multi-purpose RACF Class. Failure to activate this class will result in unprotected resources. This exposure may threaten the integrity of the operating system environment, and compromise the confidentiality of customer data.",
|
|
1328
|
+
"severity": "medium"
|
|
1329
|
+
},
|
|
1330
|
+
{
|
|
1331
|
+
"id": "V-7491",
|
|
1332
|
+
"title": "MCS consoles are not active.",
|
|
1333
|
+
"description": "(RACF0248: CAT II) MCS consoles can be used to issue operator commands. Failure to properly control access to MCS consoles could result in unauthorized personnel issuing sensitive operator commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.",
|
|
1334
|
+
"severity": "medium"
|
|
1335
|
+
},
|
|
1336
|
+
{
|
|
1337
|
+
"id": "V-7492",
|
|
1338
|
+
"title": "The OPERCMDS resource class is not active.",
|
|
1339
|
+
"description": "z/OS system commands provide a method of controlling the operating environment. Failure to properly control access to z/OS system commands could result in unauthorized personnel issuing sensitive system commands. This exposure may threaten the integrity and availability of the operating system environment, and compromise the confidentiality of customer data.",
|
|
1340
|
+
"severity": "medium"
|
|
1341
|
+
},
|
|
1342
|
+
{
|
|
1343
|
+
"id": "V-75057",
|
|
1344
|
+
"title": "The RACF SERVAUTH resource class must be active for TCP/IP resources.",
|
|
1345
|
+
"description": "IBM Provides the SERVAUTH Class for use in protecting a variety of TCP/IP features/functions/products both IBM and third-party. Failure to activate this class will result in unprotected resources. This exposure may threaten the integrity of the operating system environment, and compromise the confidentiality of customer data.",
|
|
1346
|
+
"severity": "medium"
|
|
1347
|
+
},
|
|
1348
|
+
{
|
|
1349
|
+
"id": "V-75059",
|
|
1350
|
+
"title": "RACF Global Access Checking must be restricted to appropriate classes and resources",
|
|
1351
|
+
"description": "RACF Global access checking can be used to improve the performance of RACF authorization checking for selected resources. The global access checking table is maintained in storage and is checked early in the RACF authorization checking sequence. If an entry in the global access checking table allows the requested access to a resource, RACF performs no further authorization checking. This can eliminate the need for I/O to the RACF database to retrieve a resource profile, which can result in substantial performance improvements. However, if an entry in the global access checking table allows a requested access to a resource, no auditing is done for the request. Capture of audit data ensure a historical checking of individual user accountability. This accountability is basic for forensic purposes. ",
|
|
1352
|
+
"severity": "medium"
|
|
1353
|
+
},
|
|
1354
|
+
{
|
|
1355
|
+
"id": "V-7516",
|
|
1356
|
+
"title": "CICS system data sets are not properly protected.",
|
|
1357
|
+
"description": "CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Unauthorized access to CICS system data sets (i.e., product, security, and application libraries) could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.",
|
|
1358
|
+
"severity": "medium"
|
|
1359
|
+
},
|
|
1360
|
+
{
|
|
1361
|
+
"id": "V-7545",
|
|
1362
|
+
"title": "Unsupported system software is installed and active on the system.",
|
|
1363
|
+
"description": "When a vendor drops support of System Software, they no longer maintain security vulnerability patches to the software. Without vulnerability patches, it is impossible to verify that the system does not contain code which could violate the integrity of the operating system environment. ",
|
|
1364
|
+
"severity": "high"
|
|
1365
|
+
},
|
|
1366
|
+
{
|
|
1367
|
+
"id": "V-7546",
|
|
1368
|
+
"title": "Site must have a formal migration plan for removing or upgrading OS systems software prior to the date the vendor drops security patch support.",
|
|
1369
|
+
"description": "Vendors' code may contain vulnerabilities that may be exploited to cause denial of service or to violate the integrity of the system or data on the System. Most vendors develop patches to correct these vulnerabilities. When vendors' products become unsupported, the creation of these patches cease leaving the system exposed to any future vulnerabilities not patched. Without a documented migration plan established to monitor system software versions and releases unsupported software may be allowed to run on the system.",
|
|
1370
|
+
"severity": "medium"
|
|
1371
|
+
},
|
|
1372
|
+
{
|
|
1373
|
+
"id": "V-82",
|
|
1374
|
+
"title": "A CMP (Change Management Process) is not being utilized on this system. ",
|
|
1375
|
+
"description": " Without proper tracking of changes to the operating system software environment, its processing integrity and availability are subject to compromise.",
|
|
1376
|
+
"severity": "low"
|
|
1377
|
+
},
|
|
1378
|
+
{
|
|
1379
|
+
"id": "V-8271",
|
|
1380
|
+
"title": "FTP / Telnet unencryted transmissions require Acknowledgement of Risk Letter(AORL) ",
|
|
1381
|
+
"description": "In addition to the data transmission being in the clear, the user credentials are also passed in the clear, which violates the control IAIA-1. As mitigation for this vulnerability, special consideration must be given to account maintenance and the types of user privileges associated with these accounts. Interception of the above information could result in the compromise of the operating system environment, ACP, and customer data.",
|
|
1382
|
+
"severity": "medium"
|
|
1383
|
+
},
|
|
1384
|
+
{
|
|
1385
|
+
"id": "V-83",
|
|
1386
|
+
"title": "LNKAUTH=APFTAB is not specified in the IEASYSxx member(s) in the currently active parmlib data set(s).",
|
|
1387
|
+
"description": "Failure to specify LINKAUTH=APFTAB allows libraries other than those designated as APF to contain authorized modules which could bypass security and violate the integrity of the operating system environment. This expanded authorization list inhibits the ability to control inclusion of these modules.",
|
|
1388
|
+
"severity": "medium"
|
|
1389
|
+
},
|
|
1390
|
+
{
|
|
1391
|
+
"id": "V-84",
|
|
1392
|
+
"title": "Inaccessible APF libraries defined.",
|
|
1393
|
+
"description": "If a library designated by an APF entry does not exist on the volume specified, a library of the same name may be placed on this volume and inherit APF authorization. This could allow the introduction of modules which bypass security and violate the integrity of the operating system environment.",
|
|
1394
|
+
"severity": "low"
|
|
1395
|
+
},
|
|
1396
|
+
{
|
|
1397
|
+
"id": "V-85",
|
|
1398
|
+
"title": "Duplicated sensitive utilities and/or programs exist in APF libraries.",
|
|
1399
|
+
"description": "Modules designated as sensitive utilities have the ability to significantly modify the operating system environment. Duplication of these modules causes an exposure by making it extremely difficult to track modifications to them. This could allow for the execution of invalid or trojan horse versions of these utilities.",
|
|
1400
|
+
"severity": "low"
|
|
1401
|
+
},
|
|
1402
|
+
{
|
|
1403
|
+
"id": "V-86",
|
|
1404
|
+
"title": "The review of AC=1 modules in APF authorized libraries will be reviewed annually and documentation verifying the modules integrity is available.",
|
|
1405
|
+
"description": "The review of AC=1 modules that reside in APF authorized libraries will be reviewed annually. The IAO will maintain documentation identifying the integrity and justification of Vendor APF authorized libraries. For non-vendor APF authorized libraries, the source and documentation identifying the integrity and justification that describes the AC=1 module process will be maintained by the IAO. Sites have undocumented and/or unauthorized AC=1 modules have a possible risk to the confidentiality, integrity, and availability of the system and present a clear risk to the operating system, ACP, and customer data.",
|
|
1406
|
+
"severity": "medium"
|
|
1407
|
+
},
|
|
1408
|
+
{
|
|
1409
|
+
"id": "V-90",
|
|
1410
|
+
"title": "Inapplicable PPT entries have not been invalidated.",
|
|
1411
|
+
"description": "If invalid or inapplicable PPT entries exist, a venue is provided for the introduction of trojan horse modules with security bypass capabilities.",
|
|
1412
|
+
"severity": "medium"
|
|
1413
|
+
}
|
|
1414
|
+
]
|
|
1415
|
+
}
|