V-223459

Discussion

Preventing non-privileged users from executing privileged functions mitigates the risk that unauthorized individuals or processes may gain unnecessary access to information or privileges. Privileged functions include, for example, establishing accounts, performing system integrity checks, or administering cryptographic key management activities. Non-privileged users are individuals that do not possess appropriate authorizations. Circumventing intrusion detection and prevention mechanisms or malicious code protection mechanisms are examples of privileged functions that require protection from non-privileged users.

Check Content

From the ACF command screen enter:
SET CONTROL(GSO)
LIST LIKE(PPGM-)

Refer to the table of Sensitive Utilities resources and/or generic equivalent as detailed in the table. 

If all applicable programs or their generic equivalent referenced below are represented by GSO PPGM record values, this is not a finding.

Sensitive Utility Controls
Program          Product          Function 
AHLGTF           z/OS             System Activity Tracing 
HHLGTF
IHLGTF 

ICPIOCP          z/OS             System Configuration 
IOPIOCP
IXPIOCP
IYPIOCP
IZPIOCP 

BLSROPTR         z/OS             Data Management 

DEBE             OS/DEBE          Data Management 

DITTO            OS/DITTO         Data Management 

FDRZAPOP         FDR              Product Internal Modification 

GIMSMP           SMP/E            Change Management Product 

ICKDSF           z/OS             DASD Management 

IDCSC01          z/OS             IDCAMS Set Cache Module 

IEHINITT         z/OS             Tape Management 

IFASMFDP         z/OS SMF         Data Dump Utility 

IND$FILE z/OS                     PC to Mainframe File Transfer
                                  (Applicable only for classified systems) 

CSQJU003         IBM WebSphereMQ
CSQJU004
CSQUCVX
CSQ1LOGP 
CSQUTIL 

WHOIS            z/OS              Share MOD to identify user name from USERID. 
                                   Restricted to data center personnel only.