S 2.291 Security reporting and security audits under z/OS

Initiation responsibility: IT Security Officer, Head of IT

Implementation responsibility: Administrator, Auditor, IT Security Officer

A process must therefore be set up to monitor all security-relevant operations. The security reports to be produced regularly must be specified in this process and the procedure for handling deviations from the specifications must also be defined. These security reports should be used to provide the auditors with information.

Furthermore, security audits must be conducted regularly to increase the operational reliability of a z/OS system. Such audits are used to check if the required security settings are properly set and if the required procedures are being followed. Audit specifications can be found in S 2.288 Drawing up a security policy for z/OS systems.

Security reporting

SMF (System Management Facility) records as a source of the reports

The SMF records of type 80 are important for monitoring the information security of z/OS systems. They record all accesses to resources that are protected by RACF profiles. RACF definitions in these profiles can be used to specify if unauthorised accesses only will be logged or if authorised accesses will also be logged. All unauthorised accesses must be logged. In the case of system-critical files in a production system, authorised accesses should also be logged using the SMF when the files are changed during these. When logging using SMF records, it should always be ensured that the activation of the SMF functions does not generate too much logged data. There should only be a minor impact on the capacity and the performance of the system due to logging.

It must be ensured that the SMF records of type 80 are also actually written. This is defined in the SMFPRM00 member in the Parmlib. Protecting the Parmlib is described in more detail in safeguard S 4.209 Secure basic configuration of z/OS systems.

Use of tools

z/OS security audits

Independence of the auditors

The audits must be performed by independent auditors, which means someone performing an audit is not permitted to audit himself/herself or his/her own work.

The auditors will need knowledge of the z/OS system and RACF in order to perform their tasks. This knowledge is to be obtained and updated through regular training.

Authorisation of the auditors

The auditors must be granted access to the system using the RACF attribute AUDITOR. This attribute also needs to be enabled for the files in the HFS in the corresponding file security packet (FSP).

Control over SMF records

The audit is based on the SMF records of record type 80. In this, the information in the RACF database specifies which events will be logged in the SMF records. For this reason, it must be ensured that these SMF records are actually written and available for assessment.

Examination of RACF profiles

The auditors should check the following for new RACF profiles and changes to existing RACF profiles:

Object of the security audits

A full security audit is very complex and a large number of security-relevant functions must be monitored for this purpose. The following functions should be monitored at a minimum:

Use of audit tools

The RACF DSMON and the RACFICE package should be used at a minimum to check the definitions to be monitored. It should be checked if an additional program package needs to be purchased to help the auditors perform the audits.

It is important to note that an audit should only serve to determine the facts and not who is at fault (see also S 2.199 Maintaining information security).

Review questions:

© Federal Office for Information Security. All rights reserved.