Implementing Security › Administering CICS Command Security › Securing CEMT Commands

Securing CEMT Commands

To obtain the security features in the following sections, you must ensure that the transaction CEMT has the PCT/RDO parameter RESSEC=NO. It is not necessary to separately secure the CEMT transaction through LCF or OTRAN resource checks. Instead, CEMT is secured in CA Top Secret mainly through a special SPI (Set, Perform, Inquire) resource class. Individual SPI resources are constructed from CEMT “keywords” to control the “action” in a CEMT command.

The table, SPI Access Levels for CEMT, shows the CA Top Secret ACCESS level required to execute “action” verbs in the CEMT syntax shown below.

CEMT action.keyword [(resource‑name)] [keyword‑operand value]

The table, SPI Resource Keywords, shows the correspondence between CEMT keywords and CA Top Secret SPI resource names. Because some actions in CEMT generate displays of individual resources, and allow the alteration of those resources displayed on the screen, CA Top Secret performs individual resource checks for certain resources, which are summarized in the table, CEMT Secondary Resource Checks.

The following table lists valid SPI access levels for CEMT commands:

CEMT commands have keywords relating to a specific set of actions. The next section describes how CA Top Secret secures each keyword and their associated action.

Securing INQUIRE and SET Commands

The following table lists the CEMT command keywords and their associated SPI resource names:

Examples: Securing CICS

In In this example, the user only has permission to execute the CEMT INQUIRE SYSTEM or CEMT INQUIRE commands, since SYSTEM is the default if no function is specified:

TSS ADDTO(deptacid) SPI(SYSTEM)

TSS PERMIT(acidname) SPI(SYSTEM)
                     ACCESS(INQUIRE)

In In this example, the user only has permission to execute CEMT INQUIRE DUMP commands:

TSS ADDTO(deptacid) SPI(DUMPDS)

TSS PERMIT(acidname) SPI(DUMPDS)
                     ACCESS(INQUIRE)

In In this example, the user only has permission to execute CEMT INQUIRE AUTOINSTALL commands:

TSS ADDTO(deptacid) SPI(AUTOINST)

TSS PERMIT(acidname) SPI(AUTOINST)
                     ACCESS(INQUIRE)

Note: Although authorization to SPI resources can be specified for up to 44 characters, ownership of the resource is limited to eight characters.

In In this example, the user only has permission to execute CEMT SET VTAM OPEN commands:

TSS ADDTO(deptacid) SPI(VTAM)

TSS PERMIT(acidname) SPI(VTAM) ACCESS(SET)