<?xml version="1.0" encoding="utf-8"?><?xml-stylesheet type='text/xsl' href='STIG_unclass.xsl'?><Benchmark xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:dsig="http://www.w3.org/2000/09/xmldsig#" id="zOS_BMC_CONTROL-M_Restart_for_RACF_STIG" xml:lang="en" xsi:schemaLocation="http://checklists.nist.gov/xccdf/1.1 http://nvd.nist.gov/schema/xccdf-1.1.4.xsd http://cpe.mitre.org/dictionary/2.0 http://cpe.mitre.org/files/cpe-dictionary_2.1.xsd" xmlns="http://checklists.nist.gov/xccdf/1.1"><status date="2011-01-20">accepted</status><title>zOS BMC CONTROL-M/Restart for RACF STIG</title><notice id="terms-of-use" xml:lang="en"></notice><reference href="http://iase.disa.mil"><dc:publisher>DISA, Field Security Operations</dc:publisher><dc:source>STIG.DOD.MIL</dc:source></reference><plain-text id="release-info">Release: 5Benchmark Date:30 Oct 2018</plain-text><version>6</version><Profile id="MAC-1_Public"><title>I - Mission Critical Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-16932" selected="true" /><select idref="V-21592" selected="true" /></Profile><Profile id="MAC-1_Sensitive"><title>I - Mission Critical Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-16932" selected="true" /><select idref="V-21592" selected="true" /></Profile><Profile id="MAC-1_Classified"><title>I - Mission Critical Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-16932" selected="true" /><select idref="V-21592" selected="true" /></Profile><Profile id="MAC-2_Public"><title>II - Mission Support Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-16932" selected="true" /><select idref="V-21592" selected="true" /></Profile><Profile id="MAC-2_Sensitive"><title>II - Mission Support Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-16932" selected="true" /><select idref="V-21592" selected="true" /></Profile><Profile id="MAC-2_Classified"><title>II - Mission Support Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-16932" selected="true" /><select idref="V-21592" selected="true" /></Profile><Profile id="MAC-3_Public"><title>III - Administrative Public</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-16932" selected="true" /><select idref="V-21592" selected="true" /></Profile><Profile id="MAC-3_Sensitive"><title>III - Administrative Sensitive</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-16932" selected="true" /><select idref="V-21592" selected="true" /></Profile><Profile id="MAC-3_Classified"><title>III - Administrative Classified</title><description>&lt;ProfileDescription&gt;&lt;/ProfileDescription&gt;</description><select idref="V-16932" selected="true" /><select idref="V-21592" selected="true" /></Profile><Group id="V-16932"><title>ZB000000</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-31832r1_rule" severity="medium" weight="10.0"><version>ZCTRR000</version><title>BMC CONTROL-M/Restart installation data sets are not properly protected.</title><description>&lt;VulnDiscussion&gt;BMC CONTROL-M/Restart installation data sets have the ability to use privileged functions and/or have access to sensitive data.  Failure to properly restrict access to these data sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SecurityOverrideGuidance&gt;&lt;/SecurityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;DCSL-1, ECAR-1, ECAR-2, ECCD-1, ECCD-2&lt;/IAControls&gt;</description><ident system="http://iase.disa.mil/cci">CCI-000213</ident><ident system="http://iase.disa.mil/cci">CCI002234</ident><fixtext fixref="F-373r2_fix">The IAO will ensure that update and alter access to BMC CONTROL-M/Restart installation data sets is limited to System Programmers only, and all update and alter access is logged.  Read access can be given to all authorized users.

The installing Systems Programmer will identify and document the product data sets and categorize them according to who will have update and alter access and if required that all update and alter access is logged. He will identify if any additional groups have update and/or alter access for specific data sets, and once documented he will work with the IAO to see that they are properly restricted to the ACP (Access Control Program) active on the system.

Data sets to be protected will be: 
SYS2.IOA.*.CTRO.**
SYS3.IOA.*.CTRO.**

The following commands are provided as a sample for implementing data set controls: 

ad 'SYS2.IOA.*.CTRO.**' uacc(none) owner(sys2) -
	audit(success(update) failures(read)) -
	data('BMC CONTROL-M/Restart Install DS')
pe 'SYS2.IOA.*.CTRO.**' id(&lt;syspaudt&gt;) acc(a)
pe 'SYS2.IOA.*.CTRO.**' id(&lt;audtaudt&gt;) acc(r)
pe 'SYS2.IOA.*.CTRO.**' id(ControlM &lt;bmcbatch&gt;) acc(r)

ad 'SYS3.IOA.*.CTRO.**' uacc(none) owner(sys3) -
	audit(success(update) failures(read)) -
	data('BMC CONTROL-M/Restart Operation DS')
pe 'SYS3.IOA.*.CTRO.**' id(&lt;syspaudt&gt;) acc(a)
pe 'SYS3.IOA.*.CTRO.**' id(ControlM &lt;bmcbatch&gt;) acc(r)
pe 'SYS3.IOA.*.CTRO.**' id(&lt;audtaudt&gt;) acc(r)


setr generic(dataset) refresh</fixtext><fix id="F-373r2_fix" /><check system="C-647r2_chk"><check-content-ref name="M" href="VMS_XCCDF_Benchmark_zOS BMC CONTROL-M/Restart for RACF STIG.xml" /><check-content>1.  Check with your IOA or Systems Programming personnel and compile the list of 
BMC CONTROL-M/Restart Installation Datasets,. Most likely they are similar to:
 .SYS2.IOA.*.CTRO.**  or SYS3.IOA.*.CTRO.**.
  
2. From the Administrator Main Menu Choose Option 2 Security Server 
Commands.

3. Then choose Option: 3 Data Set.

4. Type the resource names collected in option 1.  above into: "Enter fully 
qualified (without quotes) data set or profile name: ".

5. Hit enter.
 
6. Enter Y for Display covering profile? 

7. Verify that the UACC is NONE.

8. Verify that Audit Successes and Failures specifies UPDATE or READ.

9. Tab down to Standard Access Permits and place an E next to it (hit enter) .
Validate that UPDATE or higher access is limited to Systems Programming 
personnel.  Verify Read access is given to
          Auditors
          BMC Users
          BMC STCs
          Batch Users.

10. If Contitional Access Permits: _ (E to edit data) has *data is 
present* next to it, place an E next to it  and hit enter,Validate that conditional access 
permits of Update or higher are limited to Systems Programming Personnel.
Verify Read access is given to:
          Auditors
          BMC Users
          BMC STCs
          Batch Users.

11. Repeat steps 2 through 10 for all datasets in option 1.

12. If  7, 8, .9 and 10 are all true, there is NO FINDING. 

13.  If 7, 8, .9 and 10 are not true, this is a FINDING.</check-content></check></Rule></Group><Group id="V-21592"><title>ZB000002</title><description>&lt;GroupDescription&gt;&lt;/GroupDescription&gt;</description><Rule id="SV-32219r1_rule" severity="medium" weight="10.0"><version>ZCTRR002</version><title>BMC CONTROL-M/Restart Archived Sysout data sets are not properly protected.</title><description>&lt;VulnDiscussion&gt;BMC CONTROL-M/Restart Archived Sysout data sets have the ability to use privileged functions and/or have access to sensitive data.  Failure to properly restrict access to these data sets could result in violating the integrity of the base product which could result in compromising the operating system or sensitive data.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePositives&gt;&lt;FalseNegatives&gt;&lt;/FalseNegatives&gt;&lt;Documentable&gt;false&lt;/Documentable&gt;&lt;Mitigations&gt;&lt;/Mitigations&gt;&lt;SecurityOverrideGuidance&gt;&lt;/SecurityOverrideGuidance&gt;&lt;PotentialImpacts&gt;&lt;/PotentialImpacts&gt;&lt;ThirdPartyTools&gt;&lt;/ThirdPartyTools&gt;&lt;MitigationControl&gt;&lt;/MitigationControl&gt;&lt;Responsibility&gt;Information Assurance Officer&lt;/Responsibility&gt;&lt;IAControls&gt;DCSL-1, ECAR-1, ECAR-2, ECCD-1, ECCD-2&lt;/IAControls&gt;</description><ident system="http://iase.disa.mil/cci">CCI-001499</ident><fixtext fixref="F-417r2_fix">The IAO will ensure that update and alter access to BMC CONTROL-M/Restart Archived Sysout data sets are limited to System Programmers, the BMC CONTROL-M's STC(s), and/or batch user(s) only.  Read access can be given to auditors, Production Control Scheduling personnel, and scheduled batch user(s).

The installing Systems Programmer will identify and document the product data sets and categorize them according to who will have update and alter access and if required that all update and alter access is logged. He will identify if any additional groups have update and/or alter access for specific data sets, and once documented he will work with the IAO to see that they are properly restricted to the ACP (Access Control Program) active on the system.

Data sets to be protected will be: 
CTRSYS.**

The following commands are provided as a sample for implementing data set controls: 

ad 'CTRSYS.**' uacc(none) owner(CTRSYS) -
	data('BMC CONTROL-M/Restart Archived Sysout')
pe 'CTRSYS.**' id(&lt;bmcbatch&gt; CONTROLM CONTDAY) acc(a)
pe 'CTRSYS.**' id(&lt;syspaudt&gt;) acc(a)
pe 'CTRSYS.**' id(&lt;audtaudt&gt; &lt;autoaudt&gt; &lt;pcspaudt&gt;) acc(r)

setr generic(dataset) refresh</fixtext><fix id="F-417r2_fix" /><check system="C-574r3_chk"><check-content-ref name="M" href="VMS_XCCDF_Benchmark_zOS BMC CONTROL-M/Restart for RACF STIG.xml" /><check-content>1. Check with your IOA or Systems Programming personnel and compile the list of 
BMC Control-M/Restart STC and/or batch data sets datasets,. Most likely similar to 
CTRSYS.**.
2. From the Administrator Main Menu Choose Option 2 Security Server 
Commands.

3. Then choose Option: 3 Data Set.

4. Type the resource names collected in option a.1 above into: Enter fully 
qualified (without quotes) data set or profile name: 

5. Hit enter. 

6. Enter Y for Display covering profile? 

7. Verify that the UACC is NONE.

8. Tab down to Standard Access Permits and place an E next to it (hit enter) and validate that UPDATE or higher access is limited to production control and scheduling personnel, scheduled batch users, systems programming personnel, the BMC STC(s), and/or batch user(s).
Validate that READ access is permitted to auditors and BMC Users.

9. If Contitional Access Permits: _ (E to edit data) has *data is 
present* next to it, place an E next to it and validate that conditional access 
permits of UPDATE  or higher access is limited to production control and scheduling personnel, scheduled batch users, systems programming personnel, the BMC STC(s), and/or batch user(s). 
Validate that READ access is permitted to auditors and BMC Users.

10. Repeat steps 2 through 9 for all datasets in option 1. above.
.
12. If  7, 8,  9 and  10 are all true, there is NO FINDING. 

13. If .7, 8,  9 and  10 are not true, this is a FINDING.

</check-content></check></Rule></Group></Benchmark>