zSecure Audit for ACF2 Getting Started IBM GI13-2325-06 Note Before using this information and the product it supports, read the information in “Notices” on page 153. December 2019 This edition applies to version 2, release 4, modification 0 of IBM® Security zSecure Audit (product number 5655-N17) and to all subsequent releases and modifications until otherwise indicated in new editions. © Copyright International Business Machines Corporation 1998, 2019. US Government Users Restricted Rights – Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp. Contents About this publication..........................................................................................vii zSecure documentation..............................................................................................................................vii Obtain licensed documentation........................................................................................................... vii IBM Security zSecure Suite library...................................................................................................... viii IBM Security zSecure Manager for RACF z/VM library.......................................................................... x Related documentation...............................................................................................................................xi Accessibility.................................................................................................................................................xi Technical training....................................................................................................................................... xii Support information................................................................................................................................... xii Statement of Good Security Practices....................................................................................................... xii Chapter 1. Overview.............................................................................................. 1 Data sources.................................................................................................................................................2 Remote data........................................................................................................................................... 3 ACF2 terminology used in this guide...........................................................................................................3 ACF2 scoping............................................................................................................................................... 4 Sample scope records............................................................................................................................5 Scoping by default.................................................................................................................................. 6 LIST command........................................................................................................................................6 SELECT command.................................................................................................................................. 7 Screen navigation.........................................................................................................................................7 Opening the Main menu......................................................................................................................... 9 Trying out the options.............................................................................................................................9 Viewing the Rules information............................................................................................................... 9 Viewing Audit information......................................................................................................................9 Masking characters.............................................................................................................................. 10 Date fields.............................................................................................................................................10 Summary of navigation characters...................................................................................................... 10 Chapter 2. Logon ID tasks.................................................................................... 11 Accessing the Logon ID functions............................................................................................................. 11 Displaying your Logon ID...........................................................................................................................12 Displaying Logon IDs using SELECT ......................................................................................................... 15 Interpreting Logon ID settings.................................................................................................................. 17 Displaying logonids using LIST..................................................................................................................18 Displaying Logon IDs using a mask........................................................................................................... 19 Displaying logon IDs with matching UID string........................................................................................ 20 Listing logon IDs with special privileges................................................................................................... 20 Example: Find all logon IDs with SECURITY and ACCOUNT and not NON-CNCL:...............................22 Displaying all logon IDs with the same user name................................................................................... 23 Chapter 3. Rule analysis...................................................................................... 25 Data set rules............................................................................................................................................. 25 Resource rules........................................................................................................................................... 25 Viewing data set rules................................................................................................................................25 Viewing by rule set............................................................................................................................... 28 Displaying data set rules using LIST......................................................................................................... 30 Displaying data set rules using SELECT.................................................................................................... 31 Audit concerns......................................................................................................................................35 Suggestions for rule reviews................................................................................................................35 iii Displaying who last stored a rule.............................................................................................................. 36 Listing rule lines for a specific data set..................................................................................................... 37 Analyzing data set access.................................................................................................................... 39 Listing data set rule lines specific to a uid string...................................................................................... 40 Displaying NEXTKEYs in data set rules..................................................................................................... 42 Specifying additional selection criteria................................................................................................43 Data set rule structure and NEXTKEYs................................................................................................45 Displaying rules lines in expanded NEXTKEY format............................................................................... 45 Using the expanded NEXTKEYs function............................................................................................. 46 Reviewing the expanded NEXTKEY rule lines for each x line..............................................................50 Viewing individual data set rule lines........................................................................................................51 Viewing a resource rule............................................................................................................................. 53 Chapter 4. Infostorage records............................................................................ 57 Infostorage record types and attributes................................................................................................... 57 Viewing scope records...............................................................................................................................58 Viewing an individual Scope record.....................................................................................................60 Viewing