Control Option Requirements › Setting CA Top Secret Control Options › Using Suboptions or DFHSIT Parameters

Using Suboptions or DFHSIT Parameters

You can choose how to implement security for CICS initialization. You can use the DFHSIT security parameters or the equivalent CA Top Secret FACILITY suboptions to implement security for CICS initialization.

You can set a FACILITY suboption called FACMATRX to indicate whether you are using the DFHSIT security parameters or the CA Top Secret FACILITY suboptions.

• To use the FACILITY suboptions to implement security for CICS initialization, set the FACMATRX suboption to YES. Security is then implemented by the equivalent FACILITY suboptions.
• To use the DFHSIT security parameters to implement security for CICS initialization, set the FACMATRX suboption to NO.

The advantages of using CA Top Secret FACILITY suboptions for security implementation are:

• DFHSIT security parameters can be specified in several places, making it difficult to tell which parameters are actually being used.

By setting FACMATRX=YES, the security administrator can control the security parameters for CICS initialization with CA Top Secret regardless of the security parameter settings in the DFHSIT table. This provides greater control over enforced security checking by CA Top Secret for CICS.

Facility Suboptions

Both the DFHSIT security parameters and their CA Top Secret equivalent FACILITY suboptions are listed next. For a description of how to use the DFHSIT security parameters, see the IBM CICS/ESA System Definition Guide. See the Control Options Guide for information on how to specify FACILITY suboptions.

DFHSIT Parameters     FACILITY Suboptions
                      FACMATRX
SEC=                  EXTSEC=

XAPPC=                XAPPC=
XCMD=                 XCMD=
XDB2=                 XDB2=
XDCT=                 XDCT=
XFCT=                 XFCT=
XHFS=                 XHFS=
XJCT=                 XJCT=
XPCT=                 XPCT=
XPPT=                 XPPT=
XPSB=                 XPSB=
XRES=                 XRES=
XTRAN=                XTRAN=
XTST=                 XTST=
XUSER=                XUSER=
CMDSEC=               PCTCMDSEC=
RESSEC=               PCTRESSEC=
XEJB=                 XEJB=
EJBROLEPRFX=          EJBRPFRX=

XDB2=NO|resource_class

Disables resource checking, or selects and enables resource class checking, for CICS/DB2 keywords:

• DB2CONN
• DB2ENTRY
• DB2TRANS

CICS performs security checking by substituting the SIT specified resource class for the keyword. During initialization, when XDB2 specifies a resource class, and FACMATRX=NO, CICS activates a profile for the specified class. It is the administrator's responsibility to assure that the resource class specified by XDB2 has been defined to CA Top Secret. When XDB2 specifies a valid resource class, the administrator is also expected to provide security for IBMFAC(DFHDB2.) as documented by IBM in the CICS RACF Security Guide.

Selectively Disabling CAIENF/CICS Calls

The Event Notification Facility (CAIENF) automatically calls CA Top Secret when any CICS resource is accessed. CA Top Secret then processes the call based on the FACILITY control option parameters set by your site.

You can eliminate unnecessary overhead by selectively disabling calls for CICS resources that are not protected by CA Top Secret.

To disable CAIENF/CICS calls:

• The facility entry must have FACMATRX set to YES.
• Specify which CA Top Secret CAIENF intercepts you want to disable via the XPARMs; for example, if you do not want FCT checking to take place, specify XFCT=NO.

Specify FACMATRX=NO to disable this process. CA Top Secret then uses the XPARMs specified in the DFHSIT.

CICS Resource Lists

You can construct two types of resource lists:

• The Bypass List
• The Protect List

The following table details the keywords that the Bypass and Protect Lists support: