None Computing title z/OS Front End Processor for ACF2 Security Technical Implementation Guide version 7 releaseinfo Release: 2 Vuln_Num V-230183 Rule_ID SV-230183r1141503_rule Severity medium Rule_Title All hardware components of the FEPs are not placed in secure locations where they cannot be stolen, damaged, or disturbed Vuln_Discuss If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, the operator console, and the diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations. Check_Content Review site documentation to validate that procedures are in place to protect the FEP service subsystem and diskette drive: - Documents and procedures restricting access to the hardware components of the FEPs. If the hardware components of the FEPs are in secure locations, this is not a finding. Fix_Text Ensure that hardware components of the FEPs are protected as specified below: Physical security is the first level of security control for the FEPs. Install all hardware components of the FEPs in secure locations where they cannot be stolen, damaged, or disturbed. Make sure that FEP hardware is located in a secure area with limited access to authorized personnel. Not_Reviewed Vuln_Num V-230185 Rule_ID SV-230185r1141761_rule Severity medium Rule_Title A documented procedure is not available instructing how to load and dump the FEP NCP (Network Control Program). Vuln_Discuss If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, operator console, and diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations. Check_Content Review site documentation to validate that procedures are in place to protect the FEP service subsystem and diskette drive: - Documents and procedures regarding the NCP load and dump processes. If a procedure is in place relative to the NCP load and dump processes, this is not a finding. Fix_Text If documented procedures for loading and dumping the FEP NCP (Network Control Program) are not available. Create a procedure document for dumping and loading the FEP and make sure that they are available to the ISSO and to authorized personnel responsible to perform these functions. Not_Reviewed Vuln_Num V-230186 Rule_ID SV-230186r1144192_rule Severity medium Rule_Title An active log is not available to keep track of all hardware upgrades and software changes made to the FEP (Front End Processor). Vuln_Discuss If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, operator console, and diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations. Check_Content Review site documentation to validate that procedures are in place to protect the FEP service subsystem and diskette drive: - All documents and procedures that apply to FEP operations including network management, FEP initialization, IPL, shutdown, NCP dumping, backup, and recovery. If a log is in place to keep track of all hardware upgrades and software changes, this is not a finding. Fix_Text The systems programmer will notice that a log of all hardware and software upgrades/changes has been created for auditing purposes and problem tracking. All changes and upgrades will be logged. Not_Reviewed Vuln_Num V-230187 Rule_ID SV-230187r1141511_rule Severity medium Rule_Title NCP (Net Work Control Program) dataset access authorization does not restricts UPDATE and/or ALLOCATE access to appropriate personnel. Vuln_Discuss If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, the operator console, and the diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations. Check_Content Refer to the following report produced by the dataset and Resource Data Collection: - SENSITVE.RPT(NCPRPT). The ACP dataset rules for NCP datasets allow inappropriate access. If the following guidance is true, this is not a finding. The ACP dataset rules for NCP datasets restrict WRITE and/or greater access to authorized personnel (e.g., systems programming personnel). Fix_Text Identify Names of the following datasets used for installation and in development/production environments: - NCP system datasets. - NCP source definition datasets. - NCP load modules. - NCP host dump datasets. - NCP utility programs. Have the ISSO validate that they are properly protected by the ACP and that only authorized personnel are permitted WRITE and/or greater access (e.g., z/OS systems programming personnel). Not_Reviewed Vuln_Num V-230188 Rule_ID SV-230188r1141514_rule Severity medium Rule_Title A password control is not in place to restrict access to the service subsystem via the operator consoles (local and/or remote) and a key-lock switch is not used to protect the modem supporting the remote console of the service subsystem. Vuln_Discuss If components of the FEPs are not properly protected they can be stolen, damaged, or disturbed. Without adequate physical security, unauthorized users can access the control panel, operator console, and diskette drive of the service subsystem. Therefore, they can interfere with the normal operations of the FEPs. Improper control of FEP components could compromise network operations. Check_Content Review site documentation to validate that procedures are in place to protect the FEP service subsystem and diskette drive: Documents and procedures restricting access to the functions of the service subsystem from the local and/or remote operator consoles (e.g., physical access, password control, key-lock switch of modems, etc.). If the following guidance is true, this is not a finding. Verify password controls are in place to restrict access to the service subsystem via the operator consoles (local and/or remote). Verify a key-lock switch is used to protect the modem supporting the remote console of the service subsystem. Verify documents and procedures exist for any of the above functions of the service subsystem and FEP resources. Fix_Text If any of the following procedures are not in place, correct the situation by documenting the missing procedure(s). The systems programmer should validate Control authorization to use service subsystem console (local or remote) by FEP internal security control through password validation. Restrict access to these passwords to the absolutely minimum number of necessary personnel. Use of vendor default passwords is prohibited. Assign different passwords for the local and remote consoles. Disconnect the local/remote console after three unsuccessful attempts to log on. Passwords used by vendor (COMTEN, IBM, CNT, or AMDAHL) service personnel will be changed after any maintenance is done. All passwords will be changed every 90 days. Restrict permission to change passwords only to authorized personnel. Use a key lock switch on the modem supporting the remote console of the service subsystem to prevent unauthorized access. The key lock switch is only open for scheduled and authorized remote access. Not_Reviewed