CICS system resource security

This topic describes how to protect the system resources that CICS® requires.

CICS installation requirements for RACF
You can control access to the resources used by your CICS region (or regions) by using RACF® facilities. The CICS libraries supplied on the distribution volume include the CICS modules you need to support external security management.
Specifying the CICS region userid
When you start a CICS region (either as a job or as a started task) in an MVS™ environment that has RACF installed, the job or task is associated with a userid, referred to as the CICS region userid.
Authorizing CICS procedures to run under RACF
You can invoke your CICS startup procedure to start CICS as a started task or as a started job. RACF provides the ICHRIN03 procedure table for started tasks, and the STARTED general resource class for started jobs. Both options are discussed here:
Defining user profiles for CICS region user IDs
Before bringing up a CICS region, ensure that the required user IDs are defined - the CICS region user ID and the CICS default user ID.
Defining the default CICS user ID to RACF
For each CICS region where you specify SEC=YES, define a RACF user profile whose user ID matches the value of the DFLTUSER system initialization parameter.
Authorizing access to MVS log streams
Ensure that you authorize the CICS region userid to write to (and create if necessary) the log streams that are used for its system log and general logs.
Authorizing access to CICS data sets
When you have defined a region userid for your CICS job (or started task), permit that user id to access the CICS system data sets with the necessary authorization.
Authorizing access to the temporary storage pools
You can control access by temporary storage (TS) servers to the TS pools in the coupling facility.
Authorizing access to temporary storage servers
You can control access by CICS regions to the TS servers.
Authorizing access to named counter pools and servers
Authorizing access to SMSVSAM servers
SMSVSAM is a data-sharing subsystem running on its own address space to provide the RLS support required by CICS. For CICS regions using VSAM record-level sharing (RLS), access to SMSVSAM servers is controlled by RACF security checks made against the CICS region userid to verify that the region is authorized to register with an SMSVSAM server.
Authorizing access to the CICS region
You can restrict access by terminal users to specific CICS regions by defining CICS APPLID profiles in the RACF APPL class.
Controlling the opening of a CICS region's z/OS Communications Server ACB
You can control which users among those who are running non-APF-authorized programs can OPEN the z/OS® Communications Server SNA ACB associated with a CICS address space (CICS region).
Controlling userid propagation
Jobs submitted from CICS to the JES internal reader without the USER operand being specified on the JOB statement run under the CICS region user ID. These jobs have the access authorities of the CICS region itself, and so could potentially expose other data sets in the MVS system.
Surrogate job submission in a CICS environment
Batch jobs submitted by CICS can be allowed to run with a USER parameter other than the CICS region's userid, but without specifying the corresponding PASSWORD.
Authorizing the CICS region userid as a surrogate user
When CICS performs surrogate user checking, the CICS region userid must be authorized as a surrogate.
JES spool protection in a CICS environment
Your installation can protect JES spool data sets with profiles in the JESSPOOL class.
Security-related system initialization parameters
Several system initialization parameters are available for specifying system security requirements.

Parent topic: Implementing RACF protection in a single CICS region