TMA-IBM-Z-4.3
Ensure sensitive data sets are encrypted with z/OS data set encryption
Mô tả
With z/OS data set encryption, you are able to protect data residing on disk from being viewed by unauthorized users in the clear. Authorization is based on access to the key label that is associated with the data set and used by the access methods to encrypt and decrypt the data. Implementing z/OS dataset encryption ensures that even privileged users, like storage administrators, can manage sensitive data sets without being able to view the contents.
Cách kiểm tra
Phương pháp kiểm tra: Xem xét thủ công
Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.
Request a list of data sets containing sensitive data. Issue the following TSO command for each data set: LISTCAT ALL ENTRIES('<dataset-name>') Review the command output in the ENCRYPTIONDATA section. Verify that the following message appears: DATA SET ENCRYPTION-----(YES) Note: Example acceptable exclusions includes, but is not limited to: The data set is not managed by the Storage Management Subsystem (SMS). The data set type is not supported by data set encryption. Vendor documentation states the data set must not be encrypted (i.e. restrictions documented ... (full steps: CIS section 4.3)
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
Consult the z/OS DFSMS Using Data Sets: Data set encryption manual section for guidance on establishing z/OS data set encryption.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- ibm-zhardening
- Tham chiếu
- CIS IBM z/OS with RACF Benchmark v1.0.0 - 4.3 Ensure sensitive data sets are encrypted with z/OS data set encryption