← Back to z/OS IBM CICS Transaction Server for ACF2 Security Technical Implementation Guide

V-224313

CAT II (Medium)

Sensitive CICS transactions are not protected in accordance with the proper security requirements.

Rule ID

SV-224313r1141405_rule

STIG

z/OS IBM CICS Transaction Server for ACF2 Security Technical Implementation Guide

Version

V7R2

CCIs

CCI-002235

Discussion

Sensitive CICS transactions offer the ability to circumvent transaction-level controls for accessing resources under CICS. These transactions must be protected so that only authorized users can access them. Unauthorized use can result in the compromise of the confidentiality, integrity, and availability of the operating system or customer data.

Check Content

Refer to the following report produced by the z/OS Data Collection:

- EXAM.RPT(CICSPROC).

Refer to the CICS Systems Programmer Worksheets filled out from previous vulnerability ZCIC0010.

Browse the ACF2/CICS dataset allocated by the ACF2PARM DD statement in the JCL of each CICS procedure.

If the PROTLIST parameter is not specified for all CICS regions, this is not a finding.

Fix Text

The systems programmer and ISSO will ensure the ACF2/CICS parameter PROTLIST is not coded.

Browse the ACF2/CICS dataset allocated by the ACF2PARM DD statement in the JCL of each CICS procedure.

Make sure the PROTLIST parameter is not specified for all CICS regions.