+SYS.1.7.A8 Use of the z/OS Security System RACF (B)

SYS.1.7.A8 Use of the z/OS Security System RACF (B)

The use of the RACF for z/OS MUST be planned carefully. This includes the selection of a character set, the definition of rules for user IDs and passwords, and the activation of KDFAES encryption. If RACF PassTickets are used, the Enhanced PassTicket algorithm MUST be enabled. Default passwords for the RVARY command and for newly created user IDs MUST be changed. If RACF exits are to be used, their use MUST be justified, documented, and regularly monitored.

Suitable procedures MUST be defined for creating, locking, releasing, and deleting RACF IDs. After a specified number of failed login attempts, an RACF ID MUST be locked (exception: emergency user procedures). User IDs MUST also be blocked after a prolonged period of inactivity, but process IDs must not.

Files, started tasks, and security-critical programs MUST be protected with RACF profiles. Users MUST ONLY receive the data access they need in accordance with their roles. It MUST also be ensured that users are not able to extend their access options without permission.

1. Übersicht

1.1 Referenzen

1.2 Identifizierte Anforderungen

1.3 Zugehörige Regulierungen

2. Identifizierte Anforderungen

Anforderungen

3. Zugehörige Regulierungen

Regulierungen

Verknüpfte Vorgänge

Verknüpfungen
blocks G 0.14 Interception of Information / Espionage
blocks G 0.18 Poor Planning or Lack of Adaptation
blocks G 0.19 Disclosure of Sensitive Information
blocks G 0.21 Manipulation with Hardware or Software
blocks G 0.22 Manipulation of Information
blocks G 0.23 Unauthorised Access to IT Systems
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems
blocks G 0.32 Misuse of Authorisation
blocks G 0.36 Identity theft
blocks G 0.37 Repudiation of Actions
blocks G 0.39 Malware
blocks G 0.45 Data Loss
blocks G 0.46 Loss of Integrity of Sensitive Information