Ensure all command procedures are valid.

Violation reports

Description

Exemptions within the (DISK, CHECKSUM) element specify checksum values for particular files on disk. The test for the CHECKSUM constraint within this facility determines whether such an exemption has been established for all files on the system with a file type of .COM.

Limits

Exemptions

Ensure all program images are valid.

Violation reports

Description

Exemptions within the (DISK, CHECKSUM) element specify checksum values for particular files on disk. The test for the CHECKSUM constraint within this facility determines whether such an exemption has been established for all files on the system with a file type of .EXE.

Limits

Exemptions

Ensure that scanning for non-VMS malware is done.

Violation reports

Description

While there is no pattern of existing VMS viruses and malware for which one would scan, some disciplines require VMS servers to scan for viruses and malware aimed at lesser operating systems.

Currently these tests look for the Sophos Antivirus Scanner.

Limits

Exemptions

Ensure that session lock controls conform to policy.

Violation reports

Description

The test for constraint DECWINDOWS within this element looks at DECwindows control files to see the limit on inactive time before automatic session locking is invoked.

Limits

Exemptions

Ensure that backups are performed on all disks often enough to meet policy requirements.

Violation reports

Description

Backups are a necessary part of most security plans, and this test ensures that they happen at least as frequently as the local policy requires.

Violations DISK, BACKUP, ABSOLUTHI and MODIFIEDHI are not reported for files which were created since the beginning of the period during which a backup was required.

Violations DISK, BACKUP, ABSOLUTHI and MODIFIEDHI are not reported for files on CDROM disks, since even if backup were done on CDROM disks, it could not be recorded.

There are three backup-related elements within the DISK facility:

• BACKUP element
  for constraints applicable to all disk files
• BACKUPDATA element
  for constraints applicable to disk files not in SYS$SYSROOT:[*...]
• BACKUPSYS element
  for constraints applicable to disk files in SYS$SYSROOT:[*...]

The practical upper limit for a precise count of days since the last backup of a file is 9999 (about 27 years). Specification of any larger number is considered to be "forever", or since the earliest date which can be represented in the VMS time format.

If you are only concerned that files get backed up once (as compared with ensuring they are backed up on a regular basis to ensure that entire disk volumes can be restored), raise the limit or add exemptions for ABSOLUTHI).

A limit or exemption with a value of zero means there is no value which is considered unacceptable. selector

Limits

Exemptions

Testing performed for this element is based entirely on the backup date maintained by VMS. The VMS Backup program will only modify that date when the /RECORD qualifier is specified. Some sites use the /RECORD qualifier only for weekly full backups, while other sites use it for incremental backups as well. In order to fully understand the significance of backup dates it is necessary to consult with the system management staff for a particular machine to learn their procedures in this regard. 

Ensure that backups are performed on data disk files often enough to meet policy requirements.

Violation reports

Description

Backups are a necessary part of most security plans, and this test ensures that they happen at least as frequently as the local policy requires.

Violations DISK, BACKUPDATA, ABSOLUTHI and MODIFIEDHI are not reported for files which were created since the beginning of the period during which a BACKUPDATA was required.

Violations DISK, BACKUPDATA, ABSOLUTHI and MODIFIEDHI are not reported for files on CDROM disks, since even if BACKUPDATA were done on CDROM disks, it could not be recorded.

There are three backup-related elements within the DISK facility:

• BACKUP element
  for constraints applicable to all disk files
• BACKUPDATA element
  for constraints applicable to disk files not in SYS$SYSROOT:[*...]
• BACKUPSYS element
  for constraints applicable to disk files in SYS$SYSROOT:[*...]

The practical upper limit for a precise count of days since the last backup of a file is 9999 (about 27 years). Specification of any larger number is considered to be "forever", or since the earliest date which can be represented in the VMS time format.

If you are only concerned that files get backed up once (as compared with ensuring they are backed up on a regular basis to ensure that entire disk volumes can be restored), raise the limit or add exemptions for ABSOLUTHI).

A limit or exemption with a value of zero means there is no value which is considered unacceptable. selector

Limits

Exemptions

Testing performed for this element is based entirely on the backup date maintained by VMS. The VMS backup program will only modify that date when the /RECORD qualifier is specified. Some sites use the /RECORD qualifier only for weekly full backups, while other sites use it for incremental backups as well. In order to fully understand the significance of backup dates it is necessary to consult with the system management staff for a particular machine to learn their procedures in this regard. 

Ensure that backups are performed on system disk data often enough to meet policy requirements.

Violation reports

Description

Backups are a necessary part of most security plans, and this test ensures that they happen at least as frequently as the local policy requires.

Violations DISK, BACKUPSYS, ABSOLUTHI and MODIFIEDHI are not reported for files which were created since the beginning of the period during which a BACKUPSYS was required.

Violations DISK, BACKUPSYS, ABSOLUTHI and MODIFIEDHI are not reported for files on CDROM disks, since even if BACKUPSYS were done on CDROM disks, it could not be recorded.

There are three backup-related elements within the DISK facility:

• BACKUP element
  for constraints applicable to all disk files
• BACKUPDATA element
  for constraints applicable to disk files not in SYS$SYSROOT:[*...]
• BACKUPSYS element
  for constraints applicable to disk files in SYS$SYSROOT:[*...]

The practical upper limit for a precise count of days since the last backup of a file is 9999 (about 27 years). Specification of any larger number is considered to be "forever", or since the earliest date which can be represented in the VMS time format.

If you are only concerned that files get backed up once (as compared with ensuring they are backed up on a regular basis to ensure that entire disk volumes can be restored), raise the limit or add exemptions for ABSOLUTHI).

A limit or exemption with a value of zero means there is no value which is considered unacceptable. selector

Limits

Exemptions

Testing performed for this element is based entirely on the backup date maintained by VMS. The VMS backup program will only modify that date when the /RECORD qualifier is specified. Some sites use the /RECORD qualifier only for weekly full backups, while other sites use it for incremental backups as well. In order to fully understand the significance of backup dates it is necessary to consult with the system management staff for a particular machine to learn their procedures in this regard. 

Test the protection of specified files.

Violation reports

Description

This element tests protection of specific files for which you want tighter control than general files on the system. It is also the only element that tests for the presence (or absence) of particular audit or alarm ACEs (access control entries) within an ACL (access control list).

There are three types of tests included:

• Basic file protection tests ABSOLUT%% and PERCENT%%
  For certain files you may require tighter protection than your general standards.
• Identifier ACE tests ACLNO%%%
  Use of UIC identifiers directly in access control lists leads to problems if user responsibilities are changed, since control of the access they have been granted is distributed throughout the system. The purpose of this test is to ensure that identifiers used in Identifier Access Control Entries are of acceptable types.
  In addition, for certain files you might want to prohibit all forms of ACL-based access.
• Alarm and Audit ACE tests AL* and AU* (for failure and success audits)
  Auditing is the only defense against access by highly privileged users (coupled with review of the audit logs). But in some cases even for files that are not tightly protected you might want to audit access to ensure you have a record of how they are used.

This element uses limits and exemptions in a different fashion than most. Each file to be tested must be specified in an exemption, with the desired value. Limits are ignored for this element.

---

Previous

Next

Contents

Index