RACF facilities

CICS® uses a number of RACF® facilities in order to protect its resources.

Overview of RACF facilities
RACF administration
As the security administrator for one or more CICS regions, and for the users of the CICS applications, it is your job to ensure that your installation's data is properly protected.
Delegation of RACF administrative responsibility
RACF profiles
RACF user profiles
A user profile is a description of a RACF-defined user. The information in the profile includes the user ID, the user name, the user's password, the profile owner, user attributes, and other data. The user profile also contains user-related information for subsystems, including CICS.
RACF group profiles
In addition to defining individual user profiles in RACF, you can define group profiles. A group profile defines a group of users.
RACF data set profiles
Using RACF facilities, you can protect data sets on direct access storage devices (DASD) and tape by defining profiles for the data sets you want to protect.
RACF general resource profiles
RACF supplies a number of resource classes that CICS uses for its resources.
RACF classes for CICS resources
To protect a CICS resource, you must create a general resource profile for the resource in a suitable class or resource grouping class. RACF provides several classes for CICS resources. You can also define your own resource classes.
RACF classes for protecting system resources
CICS uses many system resources, and these must be protected against unauthorized access. This protection is provided by profiles in several general resource classes.
Resource classes for DB2ENTRYs
CICS supports resource security checking for CICS-defined DB2ENTRY resources, for which there are no IBM®-supplied RACF resource classes.
Summary of RACF commands
Security classification of data and users
RACF gives you the means to classify some or all of the resources on your system. You can use security levels, security categories, or both, to protect any CICS-related resource.
Defining your own resource classes
You can define your own resource classes so that you have a unique resource class name for each CICS region.
Controlling access to fields in RACF profiles
Use the FIELD resource class to define profiles that control access to fields in the RACF database.

Parent topic: Introduction to CICS security with RACF

Last updated: Sunday, 27 December 2020 23:05