The principles of good security mandate Individual Accountability. It must be possible to link each action on the system to the user who actually performed the action. In other words, accurate and complete auditing is necessary.
The amount of auditing available depends on whether or not Safeguard software or third party security products are in use on the system.
Without Safeguard software or CMON or a third party access control product, user activity and maintenance cannot be audited.
If $CMON is running, it can be configured to audit LOGONs, LOGOFFs, PROCESS starts, user adds, user deletes, and process priority changes.
Safeguard software can be configured to audit the following user- related activities:
Logons and Logoffs
Changes to Safeguard User Records
Process Creates and Opens
Attempts to access objects such as files, processes and devices
BP-USER-ADMIN-05 To provide accountability of user activities, Safeguard software should be configured to perform the auditing mandated by the Corporate Security Policy and Standards.
3P-ACCESS-AUDIT-01 Third party access control products can provide audits of user activities, capturing not just file opens but the commands issued within utilities.
3P-PROCESS-AUDIT-01 Third party process control products can audit the commands such as ALTPRI, SUSPEND or STOP requests with or without Safeguard software .
The amount and type of auditing is determined by both Safeguard Global and/or User Record audit parameters.
The Global parameters that affect user management auditing are:
AUDIT-AUTHENTICATE-PASS / FAIL
AUDIT-SUBJECT-MANAGE-PASS / FAIL
The AUDIT-AUTHENTICATE-PASS and AUDIT-AUTHENTICATE-FAIL global parameters determine whether or not Safeguard software will write audits when someone attempts to logon. Valid entries are: ALL, NONE, LOCAL and REMOTE.
How the AUDIT-AUTHENTICATE-PASS and AUDIT-AUTHENTICATE- FAIL parameters are configured depends on the Corporate Security Policy and Parameters.
BP-SAFEGARD-GLOBAL-34 The AUDIT-AUTHENTICATE-PASS global parameter should be ALL.
BP-SAFEGARD-GLOBAL-35 The AUDIT-AUTHENTICATE-FAIL global parameter should be ALL.
The AUDIT-SUBJECT-MANAGE-PASS and AUDIT-SUBJECT-MANAGE- FAIL global parameter determines whether or not Safeguard software will write User Record changes to the Safeguard Audit Trail. Valid entries are: ALL, NONE, LOCAL and REMOTE.
BP-SAFEGARD-GLOBAL-36 The AUDIT-SUBJECT-MANAGE-PASS global parameter should be ALL.
BP-SAFEGARD-GLOBAL-37 The AUDIT-SUBJECT-MANAGE-FAIL global parameter should be ALL.
The parameters in the User Record that determine which actions related to the record will be audited are:
AUDIT-USER-ACTION-PASS / FAIL
AUDIT-AUTHENTICATE-PASS / FAIL
AUDIT-MANAGE-PASS / FAIL
The AUDIT-AUTHENTICATE-PASS and AUDIT-AUTHENTICATE-FAIL parameters determine whether or not successful or unsuccessful logon attempts will be audited. The value can be ALL, NONE, LOCAL, or REMOTE.
This global attribute supplements the audit parameter for the individual User Record. If the parameter in the individual object's Protection Record is LOCAL and the Global Attribute is REMOTE, then both LOCAL and REMOTE management attempts will be audited.
The default value for both PASS and FAIL is NONE.
BP-USER-CONFIG-04 AUDIT-AUTHENTICATE-PASS = ALL
BP-USER-CONFIG-05 AUDIT-AUTHENTICATE-FAIL = ALL
The conditions specified for this attribute also apply to the system-wide auditing of automatic logoffs
The AUDIT-MANAGE-PASS and AUDIT-MANAGE-FAIL User Record parameters determine whether or not Safeguard software will write audits when someone attempts to change this particular User Record. The value can be: ALL, NONE, LOCAL and REMOTE.
BP-USER-CONFIG-06 If the Global AUDIT-SUBJECT-MANAGE-PASS attribute is not ALL, then each user record should be configured AUDIT-MANAGE-PASS ALL.
BP-USER-CONFIG-07 If the Global AUDIT-SUBJECT-MANAGE-FAIL attribute is not ALL, then each user record should be configured AUDIT-MANAGE-FAIL ALL.
The AUDIT-USER-ACTION-PASS and AUDIT-USER-ACTION-FAIL User Record parameters determine whether or not Safeguard software will write audits when the user accesses objects such as files, processes or devices, regardless of whether or not a Safeguard Protection Record for the target object exists . The value can be: ALL, NONE, LOCAL and REMOTE.
BP-USER-CONFIG-08 If the AUDIT-USER-ACTION-PASS attribute is not NONE, then each user record should be configured AUDIT-USER-ACTION-PASS NONE.
BP-USER-CONFIG-09 If the AUDIT-USER-ACTION-FAIL attribute is not ALL, then each user record should be configured AUDIT-USER-ACTION-FAIL ALL.
It is also important to realize that a single user action will generate multiple underlying events, each of which generates a Safeguard audit record. For example, if a user issues a SAFECOM INFO USER command it causes the following three underlying events:
The attempt to run SAFECOM
The attempt to open the user's terminal
The attempt to open the $ZSMP process
Simply logging on to the system will generate Safeguard audits not only as Safeguard software reads the USERID file and authenticates the user, but as the user reads the TACLLOCL and TACLCSTM files and opens any files or macros run from within these files.
RISK Setting AUDIT-USER-ACTION-PASS to call can increase the amount of auditing enough to cause an impact on system performance, especially if the SUPER.SUPER user record is configured to audit all activity.