V-224318

Discussion

IBM SDSF HASPINDX datasets control the execution, configuration, and security of the SDSF products. Failure to properly protect access to these datasets could result in unauthorized access. This exposure may threaten the availability of SDSF and compromise the confidentiality of customer data.

Check Content

If the z/OS operating system is Release 2.2 or higher, this is not applicable.

Refer to the following report produced by the dataset and Resource Data Collection:

- SENSITVE.RPT(SDSFRPT).

Automated Analysis
Refer to the following report produced by the dataset and Resource Data Collection:

- PDI(ZISF0002).

Verify that the accesses to the IBM SDSF HASPINDX dataset specified on the INDEX control statement in the ISFPARMS statements (identified in the SFSFPARM DD statement of the SDSF stc) are properly restricted. 

If the following guidance is true, this is not a finding.

The ACF2 dataset rules for the datasets restrict READ access to the auditors.

The ACF2 dataset rules for the datasets restrict UPDATE access to SDSF Started Tasks.

The ACF2 dataset rules for the datasets restrict WRITE and/or greater access to systems programming personnel.

Note: If running z/OS V1R11 or above, with the use of a new JES logical log, the HASPINDX, may not exist and may make this vulnerability not applicable (NA). However if used the HASPINDX dataset must be restricted.

Note: If running z/OS V1R11 systems or above and NOT using JES logical log, the HASPINDX dataset must be protected.