zOS Ported Tools SSH FACILITY BPX.SMF Processing Improvements

RFE for Improvements to FACILITY BPX.SMF
Reference: OA48775.pdf

The DoD STIG Team evaluated changes to FACILITY BPX.SMF that provide granular profile capabilities in the format BPX.SMF.<type>.<subtype>. We also participated in a teleconference with IBM on 29AUG2016 to discuss the results of testing we performed and the questions/observations we had.

One of the takeaway's from this meeting as well as the testing we conducted were three suggestions for improvements to the granular resource checking. Our testing was done with profiles BPX.SMF, BPX.SMF.119.94, BPX.SMF.119.96, and BPX.SMF.119.96 using SSH.

1. We request improvements to access violations to show the granular resource. In our testing, all of the ICH408 violations were against FACILITY BPX.SMF. Since we don't believe that permitting end users to BPX.SMF is a secure practice, we would like to see the granular resource such as BPX.SMF.119.96 being reported so that specific access can be permitted.
2. We would also like to request that generics be supported so that a profile such as BPX.SMF.119.* could be used. In all of our testing, fully-qualified profiles had to be used.
3. We believe that having an option within SSH to terminate a user's SSH session when SMF records are not being cut would improve security. Current processing would allow a user NOT having access to cut 119.9x records to continue with their SSH session and this would result in loss of an audit trail. This request is rooted in NIST 800-53 Rev 4 guidance under AU-5b. I have an email from our local security office on this topic that states:
The audit failure is referenced in 800-53 Rev 4. It's under AU-5 b. The CCI we use is CCI-00140 which says "The information system takes organization-defined actions upon audit failure (e.g., shut down information system, overwrite oldest audit records, stop generating audit records). The "organization-defined actions" has been determined to be "shut down information system".