Security Configuration for LU20874 and Datacom CICS Services - Datacom/DB
Article ID: 447697
Updated On:
Products
Issue/Introduction
PTF LU20874 introduces security enhancements for Datacom CICS Services to align with modern vulnerability assessment standards. These changes focus on hardening administrative functions and remote debugging (DBUG) access. Specifically, the update enforces the use of explicit operator identification (OPID) within the MSTOPR parameter of the DBCVTPR macro and enables standard CICS resource and command security for utility transactions. While legacy configurations using MSTOPR=*** functioned without error, this update transitions environments to a more secure, externally managed profile.
Resolution
- Identify authorized operators who require "master operator" status to manage Datacom CICS Services environment states.
- Define the MSTOPR parameter in the DBCVTPR macro using explicit OPID values. The parameter accepts 1 to 50 entries. MSTOPR=(ID1,ID2,...)
- Ensure these CICS OPID values match the user definitions in the External Security Manager (ESM), such as the RACF user definition CICS segment or the Top Secret (TSS) ACID definition OPIDENT field.
- Assemble the DBCVTPR with the changed MSTOPR values
- Modify the CICS System Definition (CSD) for the specified transactions to enable Resource Security (RESSEC) and Command Security (CMDSEC). For example:
ALTER TRANSACTION(DBOC) GROUP(<groupname>) RESSEC(YES) CMDSEC(YES)
ALTER TRANSACTION(DBEC) GROUP(<groupname>) RESSEC(YES) CMDSEC(YES)
When this is complete, coordinate with the CICS Security Administrator to permit the authorized ACIDs/UserIDs to the relevant CICS resource classes (e.g., FCICSFCT for files or MCICSPPT for programs) as required by the RESSEC(YES) setting.
Additional Information
References:
Feedback
