CICS Security

CICS security controls who can sign on and what each user is allowed to do. It protects transactions, files, programs, and data from unauthorized use.

Sign-on security

• Users sign on with CESN and sign off with CESF. Each userid and password is checked by an external security manager like RACF.
• A signed-on user's authority travels with every transaction they run.
• Preset security lets terminals or regions run with a default userid when no sign-on is used.
• Always sign off shared terminals. A signed-on terminal is an open door.

Resource security

• Transaction security (SIT XTRAN) checks whether the user may run each transaction.
• Resource security checks the files, programs, transient data queues, and other resources the transaction touches.
• Command security controls who can use powerful commands like CEMT and CEDA.
• Turn security on with SIT SEC=YES and the X* parameters, then define the rules in RACF.

Surrogate and distributed security

• Surrogate security lets one userid start work for another userid, for example a server transaction acting for a user.
• In MRO and ISC, the userid can flow to the remote region so security is checked there too.
• Define surrogate profiles carefully. A wide surrogate rule is as dangerous as a shared password.

Example: verifying a password in a program

• A program can check a userid and password with EXEC CICS VERIFY PASSWORD before doing sensitive work.
• WORKING-STORAGE SECTION. 01 WS-USERID PIC X(8) VALUE 'OPER001 '. 01 WS-PASSWORD PIC X(8). 01 WS-ESMREASON PIC S9(8) COMP. 01 WS-ESMRESP PIC S9(8) COMP. 01 WS-RESPONSE PIC S9(8) COMP. PROCEDURE DIVISION. EXEC CICS VERIFY PASSWORD(WS-PASSWORD) USERID(WS-USERID) ESMREASON(WS-ESMREASON) ESMRESP(WS-ESMRESP) RESP(WS-RESPONSE) END-EXEC. IF WS-RESPONSE NOT = DFHRESP(NORMAL) EXEC CICS SEND TEXT FROM('SIGN-ON FAILED') END-EXEC EXEC CICS RETURN END-EXEC END-IF.
• Never store passwords in plain text in programs. Read them from a secure prompt and clear the field after use.