Job Information › Job Entry Subsystem › Review and Security Considerations

Review and Security Considerations

Just as it is possible for someone to modify the current JES parameter file, the computer operator can switch JES parameter files at JES startup. You can detect the use of an alternate JES parameter file by reviewing the console log (SYSLOG) for the JES2 startup command. This is normally the first command entered after z/OS IPL. However, JES can be stopped and restarted at any time without an IPL. To detect a switch, search for the S JES2... operator reply to the HASP426 SPECIFY SYSTEM OPTIONS prompt. If you find that the operator entered JCL parameters or a HASPPARM= response, key them into the JES2 Parms Display (4.1). CA Auditor then locates and shows you the contents of the JES2 parameter file that started JES2.

A large number of parameters are associated with JES2, and CA Auditor reports on the parameters associated with the JOBCLASS, STCCLASS, and TSUCLASS statements. The System Review Checklist tests for the key ones, such as permitting operator commands in the JCL and bypassing tape label processing. One of these parameters is bypass label processing (BLP). This parameter permits access to any tape data sets. From a security standpoint, if the access control software does not control BLP, jobs with an ID that is permitted to bypass label processing can access any tape data sets. If the access control software on a system does control BLP, it overrides the value displayed on the JES Parms Display (4.1).

For the auditor, the most important parameters in a JES3 data center are included in the CIPARM (converter interpreter parameters) and STANDARDS statements. The CIPARM statements specify the values that govern all jobs submitted under that CIPARM ID. The STANDARDS statement specifies which CIPARM ID is used for TSO jobs, started tasks, and jobs submitted through the internal reader. Jobs that are submitted in some other way, such as through a statement reader, can be assigned a CIPARM ID by the operator when he submits the job.