Design considerations for DBCTL security
This topic explains how the various choices of IMS security can be used. When you are deciding on each part of your security design, consider the physical actions that an end user must take to obtain access to the system. You will probably use more than one type of security checking.
This topic assumes:
- A user identification as a control point
- The master terminal as a control point
- The use of RACF® protection
- The use of a region as a control point
Using password protection with command keywords
To provide verification before a command is accepted, you can require an accompanying password. The password is entered within parentheses immediately following the command verb.
Limiting access from a dependent BMP, JBP, or CCTL region
Dependent BMP, JBP, and CCTL regions are resources you should protect. You can protect them by preventing the start of an unauthorized dependent region by start of task JCL and by preventing the use of unauthorized resources in a dependent region.
Securing DBCTL dependent regions using RAS
RAS restricts the use of resources based on the user IDs of dependent regions. RAS uses RACF for security enforcement.
RAS allows an application program to access a PSB if the user ID of the dependent region in which the application program is running is authorized for that PSB. The authority of a user ID to use a PSB is defined in either the IIMS or JIMS RACF security class. RAS does not restrict the application programs that can be scheduled in a dependent region.
The IIMS and JIMS classes are predefined by RACF; however, if they have not been included with your release of RACF, you can use the RACF ICHERCDE macro to define them as new classes.
You can specify RAS by specifying ISIS=R on the initialization EXEC parameter.
- For more information about the ISIS= EXEC parameter, see IMS Version 15.4 System Definition.
- For more information about working with RACF security, see:
- Preparing a RACF security plan
- z/OS Security Server RACF Security Administrator's Guide
- For more information about the ICHERCDE macro, see z/OS Security Server RACF Macros and Interfaces.
- For more information about updating the RACF resource class descriptor table, see z/OS Security Server RACF System Programmer's Guide.