Resource security

Resource security protects CICS® resources against unauthorized access.

Introduction to resource security
Resource security provides a further level of security to transaction security, by controlling access to the resources used by the CICS transactions. A user who is authorized to invoke a particular CICS transaction might not be authorized to access files, PSBs, or other general resources used within the transaction. Unlike transaction security, which cannot be turned off for individual transactions, you can control resource security checking at the individual transaction level.
Security using the XRES resource security parameter
Use security profiles and the XRES system initialization parameter to security check a subset of CICS resources. An example of how to implement resource security for CICS document templates is provided.
Resource security checking by CICS and RACF
CICS uses RACF® to protect the resources that you can access through a CICS application program.
Security for transient data
Security for files
CICS application programs process files, which, to CICS, are logical views of physical VSAM or BDAM data sets.
Security for journals and log streams
The CICS log manager provides facilities to write to and read from the CICS system log and CICS general logs. General logs comprise user journals, forward recovery logs, and autojournals. You can implement security for journals and log streams to protect them from unauthorized access.
Security for started and XPCT-checked transactions
A CICS transaction initiated by a terminal user can start other transactions by means of an EXEC CICS START command. Transactions started in this way are known as started transactions, and you can use CICS RACF security to control who can start other transactions using the START command.
Security for application programs
You control access to the initial program specified in the transaction resource definition by authorizing the user to initiate the transaction (transaction-attach security).
Security for temporary storage
Unlike the other resources for which you specify RESSEC(YES), temporary storage queues, for which you require RACF protection, also require the security attribute in a suitable TSMODEL resource definition.
Security for z/OS UNIX files
Files stored in the z/OS® UNIX System Services file system can be used to supply Web pages through CICS Web support, as static responses provided by URIMAP definitions. When access control for these files is specified, you can control access to them on the basis of the user IDs for individual Web clients. Access control for z/OS UNIX files is enabled by default.
Security for program specification blocks
DL/I program specification blocks (PSBs) are IMS control blocks that describe databases and logical message destinations used by an application program. PSBs consist of one or more program communication blocks (PCBs), which describe an application program's interface to an IMS database.
Security checking of transactions running under CEDF or CEDX
When a transaction is run under the CEDF or the CEDX transaction, CICS checks the security settings for the target transaction.
Defining generic profiles for resources
If you control access to CICS transactions by means of transaction-attach security, there is probably only a very small subset of other resource types for which you need a further level of RACF protection.

Parent topic: Implementing RACF protection in a single CICS region

Last updated: Sunday, 27 December 2020 23:05