7xa IBM z/OS Access Control

7xa IBM z/OS Access Control

1. ACL's are stored within the resource profiles that it protects and in the RACF database

   • ACL controls direct access.
   • ACL controls conditional access
   • Can also have negative permissions
     • Everyone has read but certain users are specifically denied
   • Creator of the resource profile is the owner
     • Being the owner confers extra rights, it does not confer access it confirms rights on wether you can access the profile

2. Permissions

   • Read
   • Alter = read, update, delete
   • Update
   • Conditional
     • Conditional access can be run based on if a user is running a certain program or not
     • If you are going to allow conditional access then the program you are allowing it on needs to be controlled in some way
     • Operators who may not normally have access to a program but if they are performing a specific task that requires access then it is granted via conditional access
       • The running task is tied to the access request, it must be running for that specific purpose in order to gain access
       • Otherwise you could execute the task somewhere else and then try to grab the data
     • Slide

3. Access control levels = Multi Level Security

   • Access levels given names and numbers
     • Top secret = 100
     • Quite secret = 80
     • Private = 60
     • Therefore a users access level must be greater or equal to the level of the resource he wants to access
   • These are other than the other access control mechanisms, ACL and resource profiles

4. Access control categories

   • Non-hierarchical - compartments
     • Names representing similar security requirements
       • User must have all the categories of the resource in order to access it