Threats and Exposures › JES Considerations

JES Considerations

JES provides the system programmer with several opportunities to subvert the system, including:

• Access to the JES checkpoint data set (can contain passwords)
• Use of various exits
• Access to PROCLIBs
• JES JCL changes
• Remote name definitions.

JES Reader Definitions

JES uses one‑ to eight‑character names to identify and control its local and remote readers. CA Top Secret can use the names to allow for restricted use of sensitive or remote readers and to provide SOURCE control for selected ACIDs. If these names are changed, security for them is defeated. Ensure the integrity of these names both internally in the machine, and externally in the terminal definition files.

JES Checkpoint

JES does not encrypt or eliminate job passwords in the JCT section of the SYS1.HASPCKPT data set unless the early verify feature is used. Although TSO commands (such as QUEUE and SDSF) allow viewing of spooled input and output, they do not allow viewing of JCT entries. The system programmer can modify these programs to access and display JCT information. Restrict the use or modification of these commands, or security modifications included, to limit exposures.