Rule ID
SV-224334r1141602_rule
Version
V7R2
CCIs
DISA has directed that Quest NC-Pass extended authentication be implemented on all domains. All users with update and alter access to sensitive system-level datasets and resources, or who possess special security privileges, are required to use NC-Pass for extended authentication. Typical personnel required to use NC-Pass include, but are not limited to, systems programming, security, operations, network/communications, storage management, and production control. Improper enforcement of extended authentication through NC-Pass could potentially compromise the operating system, Access Control Program (ACP), and customer data.
Refer to the following report produced by the ACF2 Data Collection: - ACF2CMDS.RPT(TSOUSERS). If all sensitive users requiring NC-Pass validation has the AUTHSUP1 attribute, this is not a finding. Note: Sensitive users include systems programming personnel, security personnel, and other staff (e.g., DASD management, operations, auditors, technical support, etc.) with access to sensitive resources (e.g., operator commands, ACP privileges, etc.) that can modify the operating system and system software, and review/modify the security environment.
The ISSO will ensure that sensitive users are properly validated to Quest NC-Pass. Note: Sensitive users include systems programming personnel, security personnel, and other staff (e.g., DASD management, operations, auditors, technical support, etc.) with access to sensitive resources (e.g., operator commands, ACP privileges, etc.) that can modify the operating system and system software, and review/modify the security environment. The following attributes must be set for logonids requiring NC-Pass validation: SET LID CHANGE logonid AUTHSUP1