DOCSLIB.ORG

Z/OS V2R2 Security Target

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Z/OS V2R2 Security Target Security Target for IBM z/OS Version 2 Release 3 Version: 12.10 Status: RELEASE Last Update: 2019-02-25 Classification: Unclassified Security Target for IBM z/OS Version 2 Release 3 Trademarks The following terms are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both: Advanced Function Presentation AFP BladeCenter DFS DFSORT IBM Infoprint MVS PR/SM Print Services Facility Processor Resource/Systems Manager RACF System z z System VTAM z/Architecture zEnterprise z/OS z/VM zSeries z10 z12 z13 z14 Java and all Java-based trademarks and logos are trademarks or registered trademarks of Oracle and/or its affiliates. UNIX is a registered trademark of The Open Group in the United States, other countries, or both. Other company, product, and service names may be trademarks or service marks of others. IBM Corporation Classification: Unclassified Page 2 of 417 Last update: 2019-02-25 © Copyright IBM Corp. 2004, 2019 Security Target for IBM z/OS Version 2 Release 3 Revision History Revision Author(s) Date Changes to Previous Revision 12.10 Clemens Wittinger 2019-02-25 Public Version. IBM Corporation Classification: Unclassified Page 3 of 417 Last update: 2019-02-25 © Copyright IBM Corp. 2004, 2019 Security Target for IBM z/OS Version 2 Release 3 Table of Contents 1 Introduction ................................................................................................ 13 1.1 Security Target Identification ...................................................................................... 13 1.2 TOE Identification ....................................................................................................... 13 1.3 TOE Overview ............................................................................................................. 13 1.4 TOE Description .......................................................................................................... 14 1.4.1 Intended Method of Use ........................................................................................................ 15 1.4.2 Summary of Security Features .............................................................................................. 17 1.4.2.1 Identification and authentication ............................................................................................................. 17 1.4.2.2 Discretionary access control .................................................................................................................... 18 1.4.2.3 Mandatory access control and support for security labels ...................................................................... 20 1.4.2.4 Auditing .................................................................................................................................................... 21 1.4.2.5 Object reuse functionality ........................................................................................................................ 22 1.4.2.6 Security management ............................................................................................................................. 22 1.4.2.7 Communications Security ........................................................................................................................ 23 1.4.2.8 TSF protection .......................................................................................................................................... 24 1.4.2.9 Confidentiality Protection of Data Sets .................................................................................................... 24 1.4.3 Configurations ....................................................................................................................... 25 1.4.3.1 Software configuration ............................................................................................................................. 25 1.4.3.2 Hardware configuration ........................................................................................................................... 30 1.4.4 Structure ............................................................................................................................... 31 2 CC Conformance Claim ................................................................................. 32 3 Security Problem Definition ......................................................................... 33 3.1 Introduction ................................................................................................................ 33 3.2 Threat Environment .................................................................................................... 33 3.2.1 Assets ................................................................................................................................... 33 3.2.2 Threat agents ........................................................................................................................ 33 3.2.3 Threats countered by the TOE ............................................................................................... 34 3.3 Assumptions ............................................................................................................... 35 3.3.1 Environment of use of the TOE .............................................................................................. 35 3.3.1.1 Physical .................................................................................................................................................... 35 3.3.1.2 Personnel ................................................................................................................................................. 35 3.3.1.3 Procedural ................................................................................................................................................ 35 3.3.1.4 Connectivity ............................................................................................................................................. 36 3.4 Organizational Security Policies .................................................................................. 36 4 Security Objectives ...................................................................................... 38 4.1 Objectives for the TOE ................................................................................................ 38 4.2 Objectives for the Operational Environment ............................................................... 40 4.3 Security Objectives Rationale ..................................................................................... 41 4.3.1 Security Objectives Coverage ............................................................................................... 41 4.3.2 Security Objectives Sufficiency ............................................................................................. 44 5 Extended Components Definition .................................................................. 51 5.1 Class FDP: User data protection ................................................................................. 51 5.1.1 Confidentiality protection (FDP_CDP) .................................................................................... 51 5.1.1.1 FDP_CDP.1 - Confidentiality for data at rest ............................................................................................ 51 6 Security Requirements for the Operational Environment ............................... 53 IBM Corporation Classification: Unclassified Page 4 of 417 Last update: 2019-02-25 © Copyright IBM Corp. 2004, 2019 Security Target for IBM z/OS Version 2 Release 3 6.1 General security requirements for the abstract machine ........................................... 55 6.1.1 Subset access control (FDP_ACC.1(E)) ................................................................................... 55 6.1.2 Security-attribute-based access control (FDP_ACF.1(E)) ........................................................ 55 6.1.3 Static attribute initialization (FMT_MSA.3(E)) ......................................................................... 56 6.2 Security requirements for CEX3, CEX 4S, CEX5S or CEX6Sin CEX3C/CEX4C/CEX5C/CEX6C mode .................................................................................... 56 6.2.1 Cryptographic operation (RSA) (FCS_COP.1(7E)) ................................................................... 57 6.2.2 Cryptographic key generation (Public/Private Keys) (FCS_CKM.1(2E)) ................................... 57 6.3 Security requirements for CEX3, CEX 4S, CEX5S or CEX6S in CEX3A/CEX4A/CEX5A/CEX6A mode .................................................................................... 57 6.3.1 Cryptographic support operation (FCS_COP.1(6E)) ................................................................ 57 6.4 Additional Security requirements for CEX3C/CEX4C/CEX5C/CEX6C on EC12, z13 and z14 ..................................................................................................................................... 57 6.4.1 Cryptographic operation (ECC Digital Signature Generation) (FCS_COP.1(8E)) ...................... 58 6.4.2 Cryptographic operation (ECC Digital Signature Verification) (FCS_COP.1(9E)) ...................... 58 6.4.3 Cryptographic key generation (ECDSA Public/Private Keys) (FCS_CKM.1(3E)) ....................... 58 7 Security Requirements ...............................................................................
Load more

Recommended publications
  • CA Top Secret for Z/OS Control Options Guide
    CA Top Secret® for z/OS Control Options Guide r15 Ninth Edition This Documentation, which includes embedded help systems and electronically distributed materials (hereinafter referred to as the “Documentation”), is for your informational purposes only and is subject to change or withdrawal by CA at any time. This Documentation is proprietary information of CA and may not be copied, transferred, reproduced, disclosed, modified or duplicated, in whole or in part, without the prior written consent of CA. If you are a licensed user of the software product(s) addressed in the Documentation, you may print or otherwise make available a reasonable number of copies of the Documentation for internal use by you and your employees in connection with that software, provided that all CA copyright notices and legends are affixed to each reproduced copy. The right to print or otherwise make available copies of the Documentation is limited to the period during which the applicable license for such software remains in full force and effect. Should the license terminate for any reason, it is your responsibility to certify in writing to CA that all copies and partial copies of the Documentation have been returned to CA or destroyed. TO THE EXTENT PERMITTED BY APPLICABLE LAW, CA PROVIDES THIS DOCUMENTATION “AS IS” WITHOUT WARRANTY OF ANY KIND, INCLUDING WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT. IN NO EVENT WILL CA BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY LOSS OR DAMAGE, DIRECT OR INDIRECT, FROM THE USE OF THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION, LOST PROFITS, LOST INVESTMENT, BUSINESS INTERRUPTION, GOODWILL, OR LOST DATA, EVEN IF CA IS EXPRESSLY ADVISED IN ADVANCE OF THE POSSIBILITY OF SUCH LOSS OR DAMAGE.
    [Show full text]
  • Abcs of IBM Z/OS System Programming Volume 3
    Front cover ABCs of IBM z/OS System Programming Volume 3 Jose Gilberto Biondo Jr. Redbooks International Technical Support Organization ABCs of IBM z/OS System Programming Volume 3 January 2018 SG24-6983-04 Note: Before using this information and the product it supports, read the information in “Notices” on page ix. Fifth Edition (January 2018) This edition applies to version 2 release 3 of IBM z/OS (product number 5650-ZOS) and to all subsequent releases and modifications until otherwise indicated in new editions. © Copyright International Business Machines Corporation 2004, 2018. All rights reserved. Note to U.S. Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents Notices . ix Trademarks . .x Preface . xi The team who wrote this book . xi Now you can become a published author, too! . xii Comments welcome. xii Stay connected to IBM Redbooks . xiii Chapter 1. DFSMS introduction . 1 1.1 Introduction to DFSMS . 2 1.1.1 DFSMS components. 2 1.2 DFSMSdfp base element . 3 1.2.1 Managing storage . 3 1.3 DFSMSdss optional feature . 5 1.4 DFSMSrmm optional feature. 5 1.4.1 Library management . 5 1.4.2 Shelf management . 6 1.4.3 Volume management . 6 1.4.4 Data set management. 6 1.5 DFSMShsm optional feature . 6 1.5.1 Storage and space management . 6 1.5.2 Tape mount management. 7 1.5.3 Availability management . 7 1.6 DFSMStvs optional feature . 7 1.6.1 VSAM record-level sharing . 7 1.6.2 Recoverable resource management services.
    [Show full text]
  • OS Structures and System Calls
    COS 318: Operating Systems OS Structures and System Calls Kai Li Computer Science Department Princeton University (http://www.cs.princeton.edu/courses/cos318/) Outline Protection mechanisms OS structures System and library calls 2 Protection Issues CPU Kernel has the ability to take CPU away from users to prevent a user from using the CPU forever Users should not have such an ability Memory Prevent a user from accessing others’ data Prevent users from modifying kernel code and data structures I/O Prevent users from performing “illegal” I/Os Question What’s the difference between protection and security? 3 Architecture Support: Privileged Mode An interrupt or exception (INT) User mode Kernel (privileged) mode • Regular instructions • Regular instructions • Access user memory • Privileged instructions • Access user memory • Access kernel memory A special instruction (IRET) 4 Privileged Instruction Examples Memory address mapping Flush or invalidate data cache Invalidate TLB entries Load and read system registers Change processor modes from kernel to user Change the voltage and frequency of processor Halt a processor Reset a processor Perform I/O operations 5 x86 Protection Rings Privileged instructions Can be executed only When current privileged Level (CPR) is 0 Operating system kernel Level 0 Operating system services Level 1 Level 2 Applications Level 3 6 Layered Structure Hiding information at each layer Layered dependency Examples Level N THE (6 layers) . MS-DOS (4 layers) . Pros Level 2 Layered abstraction
    [Show full text]
  • CA Top Secret R16 Security Target
    CA Top Secret r16 Security Target ST Version: 1.0 August 18, 2017 3333 Warrenville Road Suite 800 Lisle, IL 60532 Prepared By: Cyber Assurance Testing Laboratory 304 Sentinel Drive, Suite 100 Annapolis Junction, MD 20701 Security Target CA Top Secret r16 Table of Contents 1 Security Target Introduction ................................................................................................................. 6 1.1 ST Reference ................................................................................................................................. 6 1.1.1 ST Identification ................................................................................................................... 6 1.1.2 Document Organization ........................................................................................................ 6 1.1.3 Terminology .......................................................................................................................... 7 1.1.4 Acronyms .............................................................................................................................. 8 1.1.5 References ............................................................................................................................. 9 1.2 TOE Reference .............................................................................................................................. 9 1.3 TOE Overview .............................................................................................................................
    [Show full text]
  • CICS Essentials Auditing CICS – a Beginner’S Guide
    CICS Essentials Auditing CICS – A Beginner’s Guide Julie-Ann Williams Mike Cairns Martin Underwood Craig Warren ii CICS ESSENTIALS Foreword by Brian Cummings A thorough Audit Guide for CICS is something that is long overdue. This document provides a wealth of information about CICS, its operations, and its various resources and capabilities along with audit guidelines and recommendations. Various documents on AuditNet and other sources have taken a stab at parts or all of CICS, but are likely not up to date or sufficiently complete. CICS largely remains an environment that holds its mysteries against auditors and security officers alike. The results of poor understanding can lead to dangerous levels of unidentified risk to the applications and sensitive information of entities that use the power of CICS for critical business applications. Unlike any other environment, CICS security implementations fail in the first place because all of the security control is often only focused on transactions. Transactions are many levels of resources removed from the data files and data bases they query or update. In the end, we see the greatest level of security established for the least sophisticated technical users – end business users, and the least security facing the most technically sophisticated – the CICS sub-system programmer and the CICS Application programmer. For example, it is typical to leave FCT resources unsecured and to allow the CICS regions to have total rights to the data sets they access. This condition gives sub-system and application programmers full-reign to use CICS utilities to inherit the CICS regions’ authorities and gain full access to freely browse and update data.
    [Show full text]
  • 402197 350 System Manual.Book
    350 Cable Survey System System Manual Covers DeepView Software Version 5.x.x and Firmware Version 3.7 TSS (International) Ltd 1, Garnett Close Greycaine Industrial Estate Watford, Herts, WD24 7GL Telephone +44 (0)1923 470800 Facsimile +44 (0)1923 470842 24 hr Customer Support +44 (0)7899 665603 e-mail: [email protected] The information in this Manual is subject to change without notice and does not represent a commitment on the part of TSS (International) Ltd Document P/N 402197 Issue 2.4 abcdef January 2008 1 9 9 3 THE QUEEN'S AWARD FOR EXPORT ACHIEVEMENT Contents CAUTIONARY NOTICE This System Manual contains full installation and operating instructions and is an important part of the 350 System. This Manual should remain easily available for use by those who will install, operate and maintain the System. WARNINGS and CAUTIONS Where appropriate, this Manual includes important safety information. Safety infor- mation appears as WARNING and CAUTION instructions. You must obey these instructions: ❐ WARNING instructions alert you to a potential risk of death or injury to users of the 350 System. ❐ CAUTION instructions alert you to the potential risk of damage to the 350 System. For your convenience, the Table of Contents section includes copies of all the WARNING and CAUTION instructions contained in this Manual. Technical Support and contact information TSS (International) Ltd 1 Garnett Close, Greycaine Industrial Estate, Watford, Herts, WD24 7GL Tel: +44 (0)1923 470800 Fax: +44 (0)1923 470842 Out of UK Hours Technical Helpline: +44 (0)7899
    [Show full text]
  • Implementing IBM Content Manager Ondemand Solutions with Case Studies
    Front cover Implementing IBM Content Manager OnDemand Solutions with Case Studies Product philosophy and history Platform specific implementation guidelines Multiple case studies for various platforms Wei-Dong (Jackie) Zhu Carol Allen Terry Brown James Ilardi Dewey Jackson Hassan A Shazly Edward E Stonesifer Vanessa T Stonesifer ibm.com/redbooks International Technical Support Organization Implementing IBM Content Manager OnDemand Solutions with Case Studies December 2007 SG24-7511-00 Note: Before using this information and the product it supports, read the information in “Notices” on page ix. First Edition (December 2007) This edition applies to Version 8 Release 4 of IBM DB2 Content Manager OnDemand for Multiplatforms (program number 5724-J33), Version 7 Release 1 of IBM DB2 Content Manager OnDemand for z/OS and OS/390 (Program Number 5655–H39), Version 5 Release 4 of IBM DB2 Content Manager OnDemand for i5/OS (Product number 5722-RD1). © Copyright International Business Machines Corporation 2007. All rights reserved. Note to U.S. Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents Notices . ix Trademarks . x Preface . xi The team that wrote this book . xii Become a published author . xiv Comments welcome. xv Part 1. Implementation guidelines. 1 Chapter 1. Introduction to IBM Content Manager OnDemand . 3 1.1 IBM Content Manager OnDemand product philosophy. 4 1.2 Content Management OnDemand history. 5 Chapter 2. IBM Content Manager OnDemand for Multiplatforms implementation guidelines. 11 2.1 Identify project resources . 12 2.2 Content Manager OnDemand server sizing . 13 2.2.1 Architecture and platform . 14 2.2.2 CPUs.
    [Show full text]
  • Brocade Mainframe Connectivity Solutions
    PART 1: BROCADE MAINFRAME CHAPTER 2 CONNECTIVITY SOLUTIONS The modern IBM mainframe, also known as IBM zEnterprise, has a distinguished 50-year history BROCADEMainframe I/O and as the leading platform for reliability, availability, serviceability, and scalability. It has transformed Storage Basics business and delivered innovative, game-changing technology that makes the extraordinary possible, and has improved the way the world works. For over 25 of those years, Brocade, MAINFRAME the leading networking company in the IBM mainframe ecosystem, has provided non-stop The primary purpose of any computing system is to networks for IBM mainframe customers. From parallel channel extension to ESCON, FICON, process data obtained from Input/Output devices. long-distance FCIP connectivity, SNA/IP, and IP connectivity, Brocade has been there with IBM CONNECTIVITY and our mutual customers. Input and Output are terms used to describe the SOLUTIONStransfer of data between devices such as Direct This book, written by leading mainframe industry and technology experts from Brocade, discusses Access Storage Device (DASD) arrays and main mainframe SAN and network technology, best practices, and how to apply this technology in your storage in a mainframe. Input and Output operations mainframe environment. are typically referred to as I/O operations, abbreviated as I/O. The facilities that control I/O operations are collectively referred to as the mainframe’s channel subsystem. This chapter provides a description of the components, functionality, and operations of the channel subsystem, mainframe I/O operations, mainframe storage basics, and the IBM System z FICON qualification process. STEVE GUENDERT DAVE LYTLE FRED SMIT Brocade Bookshelf www.brocade.com/bookshelf i BROCADE MAINFRAME CONNECTIVITY SOLUTIONS STEVE GUENDERT DAVE LYTLE FRED SMIT BROCADE MAINFRAME CONNECTIVITY SOLUTIONS ii © 2014 Brocade Communications Systems, Inc.
    [Show full text]
  • Technical Services Attachment for Technology Support Services (TSS)
    Technical Services Attachment IBM Deutschland GmbH for T echnology S upport Services (TSS) Offerings Using this Attachment, Client may order TSS offerings from IBM. Additional details are provided in Transaction Documents (TDs). The agreement in place between the parties (CRA or equivalent) referenced in the signature block, this Attachment, and TDs are the complete agreement regarding TSS transactions hereunder. 1. Services IBM will provide Services, as described in this Technical Services Attachment for TSS Offerings (Attachment) and Statements of Work (SOW), Transaction Documents, and Change Authorizations (collectively Transaction Documents or TDs), to support Client’s Eligible Machines and Eligible Programs (collectively Eligible Products). This Attachment replaces all other previously accepted versions of this Attachment for the Client named in the signature block, as to new transactions dated after the effective date of this Attachment. IBM will identify Eligible Products, Specified Locations (entire information processing environment, or a portion thereof, at multiple sites or a single building), hours of coverage selected, applicable Services, and the contract period, in TDs. Additional details may be documented in the TD, as applicable to the specific transaction. Client may place service requests 24x7, by voice or electronically, however IBM will begin servicing the request during the applicable entitled coverage days and hours. Coverage is based on the time zone where the Eligible Machine is located. IBM provides Services during the hours of service selected in the Transaction Document. Eligible Machines must meet IBM’s safety and serviceability requirements. Any IBM inspection for maintenance eligibility is subject to a charge. IBM reserves the right to inspect a Machine within one month from the start of Service.
    [Show full text]
  • Norco College Technology Committee Meeting 12:50Pm-1:50 P.M
    Norco College Technology Committee Meeting 12:50pm-1:50 p.m. CSS 219 December 13, 2017 MINUTES Present Absent Ruth Leal (Co-Chair) Cathy Brotherton (CIS/BEIT) Damon Nance (Library) Kim K. Kamerin (AHWL) Daniel Lambros (IMC) Deven Fafard (ASNC) Sergio Quiroz (ASNC) Daren Koch (Tutorial) Lenny Riley (DOI) Guest James Finley (CIS/GAM) Ricardo Aguilera (TSS) Janet Frewing (Math) Mike Angeles (TSS) Mitzi Sloniger (COMM) Frank Martinez (TSS) Vanessa Acosta (A&R) 1. Call to Order 12:50 p.m. 2. Consent Calendar- Ruth Leal a. October 19, 2017 Minutes were reviewed. b. November 9, 2017 Minutes were reviewed. Motion (Finley/Frewing). Two abstentions. Approved. 3. Technology Plan – Ruth a. Subcommittees Report - Ms. Leal provided an update regarding the subcommittees. i. Goal #6 – Phase II computers were not all installed in the summer as reported and an email has been sent to all of the users to see if their computer was replaced or still needs to be replaced. Responses are slow but the committee will continue to follow-up. TSS will use the computers in inventory which were purchased for this in last year’s resource allocation process. TSS reported that there were 53 computers in the warehouse after installation of the podium computer project. The Phase II list was shared with Business Services and TSS in the September 2017. The committee will be updated on this in the spring. The Technology Principles and Guidelines were updated to reflect the prioritization process and new template approved by the Technology Committee. The committee reviewed the document. Motion (Acosta/Sloniger).
    [Show full text]
  • Systems Introduction to OS/VS2 Release 2 First Edition (March, 1973)
    GC28-0661-1 File No. S370-34 Systems Introduction to OS/VS2 Release 2 First Edition (March, 1973) This edition is a reprint of GC28-0661{) incorporating some editorial changes. It does not obsolete GC28-0661-O. This edition applies to Release 2 of OS/VS2 and to all subsequent releases until otherwise indicated in new editions or Technical Newsletters. Changes are continually made to the information herein; before using this publication in connection with the operation of IBM systems, consult the latest IBM System/360 and System/370 Bibliography, Order No. GA22-6822, and the current SRL Newsletter. Order No. GN20-0360, for the editions that are applicable and current. Requests for copies of IBM publications should be made to your IBM representative or to the IBM branch office serving your locality. A form for readers' comments is provided at the back of this pUblication. If the form has been removed, comments may be addressed to IBM Corporation, Publications Development, iJepartment 058, Building 706-2, PO Box 390, Poughkeepsie, N.Y. 12602. Comments and suggestions become the property of IBM. © Copyright International Business Machines Corporation 1973 Preface This publication contains introductory information Design Concepts -- shows sequence of operation and about OS/VS2 Release 2, a system control other highlights of system design. program (SCP) that features virtual storage, System Requirements -- lists the basic hardware multiprogramming, multiprocessing, time sharing, requirements. and job entry subsystems. It is assumed that readers have a basic knowledge of programming Compatibility -- points out the major differences systems such as OS/MVT or OS/VS2 Release 1.
    [Show full text]
  • IBM Content Manager Ondemand Guide
    Front cover IBM Content Manager OnDemand Guide Administration, database structure, and single instance setup Storage management, security, data indexing, conversion, and expiration User exits, retention management, preferred practices, and much more Wei-Dong Zhu Jim Ilardi Deborah Matamoros Trina D Morgans Paula Muir Hassan A Shazly Edward E Stonesifer Vanessa T Stonesifer Sebastian Welter ibm.com/redbooks International Technical Support Organization IBM Content Manager OnDemand Guide October 2013 SG24-6915-03 Note: Before using this information and the product it supports, read the information in “Notices” on page xiii. Fourth Edition (October 2013) This edition applies to Version 9, Release 0, IBM Content Manager OnDemand for Multiplatforms (product number 5724-J33), Version 9, Release 0, IBM Content Manager OnDemand for z/OS (product number 5697-CMD), and Version 7, Release 1, IBM Content Manager OnDemand for i™ (product number 5770-RD1). © Copyright International Business Machines Corporation 2003, 2013. All rights reserved. Note to U.S. Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents Notices . xiii Trademarks . xiv Preface . xv Authors . xv Now you can become a published author, too! . xviii Comments welcome. xix Stay connected to IBM Redbooks publications . xix Summary of changes . xxi September 2013, Third Edition. xxi Part 1. Basic system concepts and design . 1 Chapter 1. Overview and concepts . 3 1.1 Overview of Content Manager OnDemand . 4 1.2 Content Manager OnDemand concepts . 6 1.2.1 Background information of an example company . 6 1.2.2 Reporting and documenting . 7 1.2.3 Application, application group, folder, and cabinet .
    [Show full text]