<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" id="zOS_SRRAUDIT_for_RACF_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2014-01-30">accepted</status><title>z/OS SRRAUDIT for RACF STIG</title><notice id="terms-of-use" xml:lang="en"></notice><reference><dc:publisher>DISA, Field Security Operations</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 4 Benchmark Date:April 2015</plain-text><version>6</version><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-16932" selected="true" /><select idref="V-21592" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-16932" selected="true" /><select idref="V-21592" selected="true" /></Profile><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-16932" selected="true" /><select idref="V-21592" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-16932" selected="true" /><select idref="V-21592" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-16932" selected="true" /><select idref="V-21592" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-16932" selected="true" /><select idref="V-21592" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-16932" selected="true" /><select idref="V-21592" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-16932" selected="true" /><select idref="V-21592" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-16932" selected="true" /><select idref="V-21592" selected="true" /></Profile><Group id="V-16932"><title>ZB000000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-21732r2_rule" severity="medium"><version>ZSRRR000</version><title>SRRAUDIT Install data sets are not properly protected.
</title><description>&lt;VulnDiscussion&gt;SRRAUDIT Install data sets provide the capability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to their data sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SecurityOverrideGuidance&gt;&lt;/SecurityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt; &lt;/MitigationControl&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;DCSL-1, ECAR-1, ECAR-2, ECCD-1, ECCD-2&lt;/IAControls&gt;</description><ident system="http://iase.disa.mil/cci">CCI-000213</ident><ident system="http://iase.disa.mil/cci">CCI-002234</ident><fixtext fixref="F-20320r1_fix">The IAO will ensure that update and alter access to program product install data sets is limited to System Programmers, and read access is limited to Security personnel and Auditors, and all update and alter access is logged.

The installing System Programmer will identify and document the product data sets and categorize them according to who will have update and alter access and if required that all update and alter access is logged. He will identify if any additional groups have update access for specific data sets, and once documented he will work with the IAO to see that they are properly restricted to the ACP (Access Control Program ) active on the system.

Data set prefix to be protected will be:

SYS2.SRRAUDIT.

The following commands are provided as a sample for implementing dataset controls: 

ad 'sys2.srraudit.**' uacc(none) owner(sys2) -                  
 audit(success(update) failures(read)) -                        
 data('Vendor DS Profile: SRRAUDIT -                            
 security automation project, sso-developed self-audit toolkit')
pe 'sys2.srraudit.**' id(syspaudt) acc(a) 
pe 'sys2.srraudit.**' id(secaaudt audtaudt) acc(r)</fixtext><fix id="F-20320r1_fix" /><check system="C-27823r1_chk"><check-content-ref name="M" href="VMS_XCCDF_Benchmark_zOS SRRAUDIT for RACF STIG.xml" /><check-content>


a)    Check with your IOA or Systems Programming personnel and compile the list of 
SRRAUDIT installation datasets, Likely:
1.    hlq.SRRAUDIT.**
2.    From the Administrator Main Menu choose Option  2  Security Server 
Commands
3.    then choose Option:  3   Data Set
4.    Type the resource names collected in option a.1 above into: Enter fully 
qualified (without quotes) data set or profile name: 
   ____________________________________________                  
5.    Hit enter.  
6.    Enter Y for Display covering profile? Y
7.    Verify that the UACC is NONE
8.    Verify that Audit Successes and Failures specifies UPDATE or READ.
9.    Tab down to Standard Access Permits and place an E next to it (hit enter)and 
validate that UPDATE or higher access is limited to Systems Programming 
personnel.  READ access is allowed for Systems Programming personnel, 
domain level production control and scheduling personnel, and security personnel and auditors.
10.     if CONDITIONAL ACCESS PERMITS: _ (E to edit data) has *data is 
present* next to it, place an E next to it and validate that conditional access 
permits of Update or higher are limited to Systems Programming Personnel as 
well. READ access is allowed for Systems Programming personnel, security 
personnel and auditors    
11.    Repeat steps 2 through 10 for all datasets in option a.1

b)       If a.7, a.8, a.9 and a.10 are all true, there is NO FINDING. 
 
c)       If a.7, a.8, a.9 and a.10 are not true, this is a FINDING.



___
</check-content></check></Rule></Group><Group id="V-21592"><title>ZB000002</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-23903r2_rule" severity="medium"><version>ZSRRR002</version><title>SRRAUDIT User data sets are not properly protected.</title><description>&lt;VulnDiscussion&gt;SRRAUDIT User data sets provide the capability to use privileged functions and/or have access to sensitive data. Failure to properly restrict access to their data sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SecurityOverrideGuidance&gt;&lt;/SecurityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt; &lt;/MitigationControl&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;DCSL-1, ECAR-1, ECAR-2, ECCD-1, ECCD-2&lt;/IAControls&gt;</description><ident system="http://iase.disa.mil/cci">CCI-001499</ident><fixtext fixref="F-22366r1_fix">The IAO will ensure that read, update, and alter access to program product user data sets is limited to System Programmers, Security Personnel, and Auditors and all update and alter access is logged.

The installing System Programmer will identify and document the product user data sets and categorize them according to who will have update and alter access and if required that all update and alter access is logged. He will identify if any additional groups have update access for specific data sets, and once documented he will work with the IAO to see that they are properly restricted to the ACP (Access Control Program ) active on the system.

Data set prefix to be protected will be:

SYS3.SRRAUDIT.

The following commands are provided as a sample for implementing dataset controls: 

ad 'sys3.srraudit.**' uacc(none) owner(sys3) -                  
 audit(success(update) failures(read)) -                        
 data('Vendor DS Profile: SRRAUDIT -                            
 security automation project, sso-developed self-audit toolkit')
pe 'sys3.srraudit.**' id(syspaudt secaaudt audtaudt) acc(a) 

If doing a full SRR review using the z/OS STIG Instruction, the following data set prefix to be protected will be:

SYS3.FSO.

The following commands are provided as a sample for implementing dataset controls: 

ad 'sys3.fso.**' uacc(none) owner(sys3) -                  
 audit(success(update) failures(read)) -                        
 data('Used for full SRR Review')                   
pe 'sys3.fso.**' id(syspaudt secaaudt audtaudt) acc(a) </fixtext><fix id="F-22366r1_fix" /><check system="C-27825r1_chk"><check-content-ref name="M" href="VMS_XCCDF_Benchmark_zOS SRRAUDIT for RACF STIG.xml" /><check-content>


b)    Check with your IOA or Systems Programming personnel and compile the list of 
SRRAUDIT USER datasets, Likely:
1.    hlq.SRRAUDIT.**
2.    From the Administrator Main Menu choose Option  2  Security Server 
Commands
3.    then choose Option:  3   Data Set
4.    Type the resource names collected in option a.1 above into: Enter fully 
qualified (without quotes) data set or profile name: 
   ____________________________________________                  
5.    Hit enter.  
6.    Enter Y for Display covering profile? Y
7.    Verify that the UACC is NONE
8.    Verify that Audit Successes and Failures specifies UPDATE or READ.
9.    Tab down to Standard Access Permits and place an E next to it (hit enter)and 
validate that the RACF data set rules for the data sets restricts READ, 
UPDATE, and/or ALTER access to systems programming personnel, security 
personnel, and auditors 
10.    if CONDITIONAL ACCESS PERMITS: _ (E to edit data) has *data is 
present* next to it, place an E next to it and validate that conditional access 
permits for the data sets restricts READ, UPDATE, and/or ALTER access to 
systems programming personnel, security personnel, and auditors.
11.    Repeat steps 2 through 10 for all datasets in option a.1

b)       If a.7, a.8, a.9 and a.10 are all true, there is NO FINDING. 
 
c)       If a.7, a.8, a.9 and a.10 are not true, this is a FINDING.

</check-content></check></Rule></Group></Benchmark>