V-224734
z/OS IBM CICS Transaction Server for TSS Security Technical Implementation Guide
Title
CICS logonid(s) must be configured with proper timeout and signon limits.
Description
<VulnDiscussion>CICS is a transaction-processing product that provides programmers with the facilities to develop interactive applications. Improperly defined or controlled CICS userids (i.e., region, default, and terminal users) may provide an exposure and vulnerability within the CICS environment. This could result in the compromise of the confidentiality, integrity, and availability of the CICS region, applications, and customer data.</VulnDiscussion><FalsePositives></FalsePositives><FalseNeg...
Fix Text (Documentation Requirement)
Review all CICS region, default, and end-user userids to ensure they are defined and controlled as required. Ensure that all ACIDs authorized to access a CICS facility have their OPTIME field set to 15 minutes. Ensure that all ACIDs authorized to access a CICS facility restrict SIGNMULTI to test and development use. Example: TSS ADDTO(acid) OPTIME(hhmm) TSS ADDTO(acid) FACILITY(facility) SIGNMULTI