Changes to security

This section summarizes the changes that relate to security across supported CICS® releases. Use this information to plan the impact of upgrading from one release to another.

If you are upgrading from an end-of-service release, you can find information about the changes that are relevant to those releases in Summary of changes from end-of-service releases.

For information about changes to RACF® classes, see Changes to RACF classes.

Changes to security across supported CICS TS releases are classified into the following security principles as described in What does security mean in CICS?. Liberty-related security changes are marked by a Liberty tag.

Authentication

6.3CICS TS 6.3
NEW:
  • MFA terminal sign-on has been improved for users with expired credentials. Users can now use the SETROPTS CLASSACT(IDTDATA) command to activate the IDTDATA class in RACF® to logon and change expired credentials.
6.2CICS TS 6.2
NEW:
  • The CERTEXPIRYWARN SIT parameter allows CICS to warn about expiring certificates received from the partner system over TLS connections.
  • Message DFHSO1100I provides diagnostic information about the expiring certificate.
  • The socket domain trace point (SO 0863) returns diagnostic information about the expiring certificate.
Service NEW with APAR PH63625:
  • MFA terminal sign-on has been improved for users with expired credentials. Users can now use the SETROPTS CLASSACT(IDTDATA) command to activate the IDTDATA class in RACF® to logon and change expired credentials.
CHANGED:
  • New options CHANGETIME, DAYSLEFT, EXPIRYTIME, INVALIDCOUNT, and LASTUSETIME reveal more information about the sign-on user ID and password.
6.1CICS TS 6.1
Service NEW with APAR PH63625:
  • MFA terminal sign-on has been improved for users with expired credentials. Users can now use the SETROPTS CLASSACT(IDTDATA) command to activate the IDTDATA class in RACF® to logon and change expired credentials.
CHANGED:
  • New option GMEXITOPT for ASSIGN shows the GMTRAN terminal session behavior option on a PF3 or PF15.
Service CHANGED with APAR PH59547:
  • SIGNON: New options CHANGETIME, DAYSLEFT, EXPIRYTIME, INVALIDCOUNT, and LASTUSETIME reveal more information about the sign-on user ID and password.
5.6CICS TS 5.6
NEW:
CHANGED:

Authorization

betaCICS TS beta
CHANGED:
  • The COVE, COVP, and COVU transactions are now classified as Category 3 and no longer require access to be defined in RACF.
  • CICS performs surrogate user checking if the system initialization parameter XUSER=YES or XUSER=SUBMIT or XUSER=DFHSUBMT is in effect. For more information on XUSER and its values, refer XUSER.
  • The XUSER system initialization parameter has been modified to enable separate surrogate user checks.
6.3CICS TS 6.3
NEW:
  • Tasks that are started at a terminal by using the START command, are now subject to surrogate security checks. If the user that issued the start (surrogateUserID) is different to the user ID currently signed on to the target terminal at the time the started task executes (executionUserID), a surrogate check will be made against executionUserID.DFHTRMID. If surrogate security is active in CICS (XUSER=YES) then you need to ensure that the appropriate profiles exist in the RACF SURROGAT class to allow for any required terminal START commands to succeed. See Surrogate security.
6.2CICS TS 6.2
NEW:
CHANGED:
  • To conform with a zero trust strategy, all CICS transactions, excluding CJXA and CICSPlex® SM transactions (CO**), are defined with CMDSEC(YES) and RESSEC(YES) to perform command and resource security checking. For a list of affected CICS transactions, see CICS transactions subject to security checking.
  • For the security of user-defined transactions, to conform with a zero trust strategy, the default values of CMDSEC and RESSEC attributes are changed to YES for all newly defined TRANSACTION resources.
  • Command security checking for INQUIRE NETNAME, INQUIRE NETNAME, and SET TERMINAL commands is not performed if the task or program that issues the command was started or attached to the same terminal that is being inquired or modified by the command, with a few exceptions.
  • CICS surrogate user checking is made if system initialization parameter XUSER=YES is in effect. The default job user ID for a JOB card that is submitted, without a USER parameter, by using SPOOL commands to the internal reader, is subject to the INTRDRJOBUSER system initialization parameter instead of a feature toggle that is now made obsolete. By the default of INTRDRJOBUSER, the task user ID is assumed while in 5.5 through 6.1 the CICS region user ID is assumed.
  • First-stage shutdown PLT programs always run with CMDSEC(YES) and RESSEC(YES), regardless of the security attributes of the transaction that issued the PERFORM SHUTDOWN command.
6.1CICS TS 6.1
NEW:
Service NEW with APAR PH64387:

Integrity

6.2CICS TS 6.2
NEW:
6.1CICS TS 6.1
NEW:
Service NEW with APAR PH55370:
5.6CICS TS 5.6
Service NEW with APAR PH55369:

Confidentiality

betaCICS TS beta
NEW:
CHANGED:
  • The PERFORM SSL REBUILD command has been enhanced to additionally reload all the cipher suite specification files used by the CICS resources. New messages, DFHSO0182 and DFHSO0183, report whether the cipher file refresh has failed or completed successfully.
6.3CICS TS 6.3
CHANGED:
  • Use of the default cipher suite specification file (defaultciphers.xml) is always enabled.
  • TLS 1.1 usage fields removed from TCP/IP global statistics
6.2CICS TS 6.2
NEW:
  • Feature toggle com.ibm.cics.tls.minimumkeystrength allows you to set a minimum key size for ECC, RSA, DSA, and Diffie-Hellman keys during TLS handshakes.
  • Message DFHIS2041 indicates an attempt to acquire the named IPCONN failed because of unsecured TCPIP connections with a partner system that is located outside the sysplex.
CHANGED:
  • The KEYRING system initialization parameter SIT parameter accepts more formats of key ring names to allow use of key rings that are not owned by the region user ID.
  • Sysplex caching for TLS 1.3 is supported. See SSLCACHE system initialization parameter.
  • CICS uses a minimum key size of 256 for ECC keys and 2048 for RSA, DSA and Diffie-Hellman keys during TLS handshakes. SeeIncrease minimum key size for TLS connections.

  • com.ibm.cics.web.defaultcipherfile is extended to apply to URIMAP resources with no ciphers specified.

  • Cipher suites that use NULL, Triple DES (3DES) and RC4 encryption are removed from the sample default cipher suite specification file (defaultciphers.xml). See Changes to samples.
  • For a CICSPlex SM WUI server (CPSMCONN=WUI), TCPIPSSL is mandatory if security is active.
  • For a CICS System Management Single Server (SMSS) defined with CPSMCONN=SMSSJ, CMCISSL is mandatory if security is active.
  • WS-Security now requires IBM® XML Toolkit for z/OS® v1.11.
6.1CICS TS 6.1
NEW:
Service NEW with APAR PH51719:
  • Feature toggle com.ibm.cics.tls.minimumkeystrength allows you to set a minimum key size for ECC, RSA, DSA, and Diffie-Hellman keys during TLS handshakes.
CHANGED:
Service CHANGED with APAR PH49261:
Service CHANGED with APAR PH60212:

  • com.ibm.cics.web.defaultcipherfile is extended to apply to URIMAP resources with no ciphers specified.

5.6CICS TS 5.6
NEW:
Service NEW with APAR PH38091:
  • Feature toggle com.ibm.cics.web.defaultcipherfile is available and applies to outbound HTTP requests using EXEC CICS WEB OPEN or EXEC CICS INVOKE SERVICE commands that do not specify CIPHERS or URIMAP.
Service NEW with APAR PH50175:
  • Feature toggle com.ibm.cics.tls.minimumkeystrength allows you to set a minimum key size for ECC, RSA, DSA, and Diffie-Hellman keys during TLS handshakes.
CHANGED:
  • The default is changed from SHOW to HIDE. The HIDE option replaces HIDETC.
Service CHANGED with APAR PH49253:

Auditing

6.2CICS TS 6.2
CHANGED:
  • New health check: CICS_STABILIZED_FUNCTIONS

  • When logging is disabled for QUERY SECURITY, CICS security domain statistics are still written to XSG_AUTHOR_FAIL_NL_NA and XSG_AUTHOR_FAIL_NL_NF fields, with DFHSTUP names Failed authorizations NOLOG NOTAUTH and Failed authorizations NOLOG NOTFND respectively.

  • When logging is disabled for QUERY SECURITY, CICS monitoring data is still written to XSNLNACT and XSNLNFCT fields.

6.1CICS TS 6.1
NEW:
CHANGED:
  • IBM Health Checker for z/OS support:

    New health checks that define best practices for CICS security:

    • CICS_CAT3_CONFIGURATION
    • CICS_REGION_CONFIGURATION
    • CICS_RESOURCE_CONFIGURATION
    • CICS_RESOURCE_SECURITY
    • CICS_USS_CONFIGURATION
5.6CICS TS 5.6
NEW:

Performance

6.2CICS TS 6.2
NEW:

Stabilized

6.1CICS TS for z/OS, Version 6.1
STABILIZED:

Deprecated or removed

betaCICS TS for z/OS, beta
REMOVED:
  • The feature toggle com.ibm.cics.spool.surrogate.check for surrogate user checking is no longer supported.
6.3CICS TS for z/OS, Version 6.3
REMOVED:
6.1CICS TS for z/OS, Version 6.1
REMOVED:
DEPRECATED:
  • Numeric CIPHERS
5.6CICS TS for z/OS, Version 5.6
REMOVED:

EXCI SURROGCHK option: Surrogate checking is always done. Specifying SURROGCHK=YES in the EXCI options table, DFHXCOPT, is accepted for compatibility.