Ensure that started tasks defined with the PRIVILEGED attribute is justified

TinggiLevel 1Tinjauan manualibm-z

Deskripsi

Some started tasks require access to a broad set of resources, making it impractical to permit the started task to each of these resources individually. In these cases, the security administrator can choose between assigning the TRUSTED attribute and the PRIVILEGED attribute. A lack of logging can result in loss of visibility as to what protected resources a started task is accessing.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Issue the following TSO command: SETROPTS LIST Review the command output in the ACTIVE CLASSES = section. Verify that STARTED appears. Review the command output in the GENERIC PROFILE CLASSES = section. Verify that STARTED appears. Review the command output in the SETR RACLIST CLASSES = section. Verify that STARTED appears. Request the following DSMON report: FUNCTION SYSTEM RACSPT Review the report and for any profiles that have YES in the PRIVILEGED column: Verify that the PRIVILEGED attribute assignment is justified. Note: Examples of PRIVILEGED ... (full steps: CIS section 2.4.5)

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

To activate RACF classes use the RACF SETROPTS command: SETROPTS CLASSACT(STARTED) To enable generic profile checking for a RACF class use the RACF SETROPTS command: SETROPTS GENERIC(STARTED) To RACLIST a RACF class use the RACF SETROPTS command: SETROPTS RACLIST(STARTED) To replace PRIVILEGED with TRUSTED on a STARTED profile use the RACF RALTER and SETROPTS commands: RALTER STARTED <profile> + STDATA(TRUSTED) SETROPTS REFRESH RACLIST(STARTED)

Properti

Sistem operasi: Apa saja
Tag: ibm-zhardening
Referensi: CIS IBM z/OS with RACF Benchmark v1.0.0 - 2.4.5 Ensure that started tasks defined with the PRIVILEGED attribute is justified