V-223714
IBM z/OS RACF Security Technical Implementation Guide
Title
IBM RACF assignment of the RACF OPERATIONS attribute to individual userids must be fully justified.
Description
<VulnDiscussion>This requirement is intended to cover both traditional interactive logons to information systems and general accesses to information systems that occur in other types of architectural configurations (e.g., service-oriented architectures).</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyT...
Fix Text (Documentation Requirement)
Review all USERIDs with the OPERATIONS attribute. Ensure documentation providing justification for access is maintained and filed with the ISSO, and that unjustified access is removed. A sample command to remove the OPERATIONS attribute from a userid is shown here: ALU <userid> NOOPERATIONS To remove the Group-Operations attribute: CO <user> GROUP(<groupname>) NOOPERATIONS