CXL

©2008 CXL - VScan

 

  

 

Report for Demo
Company
Business Unit
Location
System .

Report name c:\tbxnew-works\reports\myrepv.html
Report date 24-Feb-2008

Key to colors
RISKS Low risk Medium risk High risk
RESULTS Correct or low impact Medium impact Major problem

No Code Test Results
1 SUMMARY Summary .
1.1 PRIVS Privileges 15high users.
1.2 LEVELS Levels Level 0 - 0 Level 1 - 0 Level 2 - 0 Level 3 - 48 Level 4 - 5 Level 5 - 0 Level 6 - 10
1.3 FLAGS Flags -
1.4 NETLI Network Logins -
2 PWDS Passwords .
2.1 PWDLIFE Password life 89 days.
2.2 PWDLIFESTD Password life vs. standards 26
2.3 PWDCHANGES Distribution of password changes 167 average days.
2.4 PWDLEN Password length 6 chrs.
2.5 PWDLENSTD Password length vs. standards 23
3 A/C Accounts .
3.1 UNA/C Unused accounts 10
3.2 NOOWN No owners 12
4 SPAC Specific accounts .
4.1 AC-SYSTEM SYSTEM Account Done
4.2 AC-FIELD FIELD Account Done
4.3 AC-DEFAULT DEFAULT Account Done
5 LOGINS Logins .
5.1 LINOI Non-interactive Logins 2
5.2 LIBOT Both types of login 5
5.3 LIINT Interactive logins 45
5.4 LLOGINS Last logins 98 days.
5.5 LIFAIL Login failures 15 users.
5.6 DEFDIR Default Directories 5 users.
5.7 CLI CLI 21 users.
5.8 LGICMD LGICMD 15 users.
5.9 NCAPTIVE Non-Captive 10 users.
6 UICS UICs .
6.1 SHUICS Shared UICs 8 UICs
6.2 LOWUICS Low value UICs 13
7 SYSSET System settings .
7.1 UNLCPU Unlimited cpu 0
7.2 PRCLM PRCLM 0
7.3 MXDETACH Max Detached 59
8 FLAGS Flags .
8.1 CAPTIVE Captive 52 users.
8.2 DISWELCOME Diswelcome 0 users.
8.3 DISNEWMAIL Disnewmail 0 users.
8.4 DISMAIL Flag - Dismail 4 users.
8.5 GENPWD Flag - Genpwd 0 users.
8.6 DISIMAGE Flag - Disimage 0 users.
8.7 DISRECONNECT Flag - Disreconnect 0 users.
8.8 DISREPORT Flag - Disreport 0 users.
8.9 DISUSER Flag - Disuser 6 users.
8.10 LOCKPWD Flag - Lockpwd 4 users.
8.11 PWD_EXPIRED Flag - Pwd_expired 0 users.
8.12 RESTRICTED Flag - Restricted 47 users.
8.13 DISPWDDIC Flag - Dispwddic 61 users.
8.14 DEFCLI Flag - Defcli 0 users.
8.15 DISCTLY Flag - Disctly 48 users.
8.16 AUDIT Flag - Audit 2 users.
8.17 AUTOLOGIN Flag - AutoLogin 0 users.
8.18 DISFORCE_PWD_CHANGE Flag - Disforce_pwd_change 0 users.
8.19 DISPWDHIS Flag - Dispwdhis 0 users.
8.20 PWD2_EXPIRED Flag - Pwd2_Expired 3 users.
8.21 EXTAUTH Flag - External authentication 0 users.
8.22 VMSAUTH Flag - VMSauth 0 users.
8.23 PWDMIX Flag - PwdMix 2 users.
8.24 DISPWDSYNCH Flag - DisPwdSynch 3 users.
9 LEVELS Levels .
9.1 LEVELS4-6 Levels 4 to 6 14 users.
10 PRIVS Privileges .
10.1 ACNT Privilege - Acnt 1 users.
10.2 ALLSPOOL Privilege - Allspool 1 users.
10.3 ALTPRI Privilege - Altpri 2 users.
10.4 BUGCHK Privilege - BugChk 2 users.
10.5 BYPASS Privilege - ByPass 5 users.
10.6 CMEXEC Privilege - Cmexec 1 users.
10.7 CMKRNL Privilege - Cmkrnl 2 users.
10.8 DETACH Privilege - Detach 1 users.
10.9 DIAGNOSE Privilege - Diagnose 1 users.
10.10 EXQUOTA Privilege - Exquota 1 users.
10.11 GROUP Privilege - Group 1 users.
10.12 GRPNAM Privilege - Grpnam 1 users.
10.13 GRPPRV Privilege - Grpprv 1 users.
10.14 LOGIO Privilege - LogIO 2 users.
10.15 MOUNT Privilege - Mount 1 users.
10.16 NETMBX Privilege - Netmbx 1 users.
10.17 OPER Privilege - Oper 12 users.
10.18 PFNMAP Privilege - Pfnmap 1 users.
10.19 PHYIO Privilege - Phyio 2 users.
10.20 PRMCEB Privilege - Prmceb 2 users.
10.21 PRMGBL Privilege - Prmgbl 2 users.
10.22 PRMMBX Privilege - Prmmbx 2 users.
10.23 PSWAPM Privilege - Pswapm 1 users.
10.24 READALL Privilege - Readall 4 users.
10.25 PSECY Privilege - Security 2 users.
10.26 SETPRV Privilege - Setprv 2 users.
10.27 SHARE Privilege - Share 1 users.
10.28 SHMEM Privilege - Shmem 1 users.
10.29 SYSGBL Privilege - Sysgbl 1 users.
10.30 SYSLCK Privilege - Syslck 1 users.
10.31 SYSNAM Privilege - Sysnam 2 users.
10.32 SYSPRV Privilege - Sysprv 3 users.
10.33 TMPMBX Privilege - Tmpmbx 3 users.
10.34 VOLPRO Privilege - Volpro 2 users.
10.35 WORLD Privilege - World 2 users.
10.36 AUDIT Privilege - Audit 1 users.
10.37 DGRADE Privilege - Downgrade 1 users.
10.38 PIMPT Privilege - Import 1 users.
10.39 UGRADE Privilege - Upgrade 1 users.
10.40 IPNATE Privilege - Impersonate 3 users.
10.41 OVERALL Flags/Privilege - Overall -

 

 

 

1 SUMMARY Summary
Risk
The following sections summarise the key areas of this review.

1.1 PRIVS Privileges
Risk
Privileges determine what a user can and cannot do on a system. They determine what processes will work for a user.
The most important privileges are the ones which permit the user to run the AUTHORIZE program which then enables them to create accounts with whatever privileges they wish.
Such an account will have full access to all the data, software and even the logs recording the activity of the users.
Actions
With these privileges a user can do anything to your system and cover their tracks. Privileges at or above level 4 fall into this category.
Results
 Number of users with the following privileges:

 Level   Privilege            No.    %
 1       Mount                 1     2
 1       Netmbx               63   100
 1       Tmpmbx               63   100
 2       Group                63   100
 2       Grpprv                1     2
 3       Acnt                  1     2
 3       Allspool              1     2
 3       Bugchk                0     0
 3       Exquota               1     2
 3       Grpnam               63   100
 3       Prmceb                2     3
 3       Prmgbl                0     0
 3       Prmmbx                2     3
 3       Shmem                 1     2
 4       Altpri                2     3
 4       Oper                 13    21
 4       Pswapm                1     2
 4       Security              2     3
 4       Syslck                1     2
 4       World                 2     3
 4       Audit                 1     2
 5       Diagnose              1     2
 5       Sysgbl                0     0
 5       Volpro                2     3
 5       Import                0     0
 6       Bypass                5     8
 6       Cmexec                1     2
 6       Cmkrnl                2     3
 6       Detach                1     2
 6       Log_IO                2     3
 6       Pfnmap                1     2
 6       Phy_IO                2     3
 6       Readall               4     6
 6       Setprv                2     3
 6       Share                 1     2
 6       Sysnam                2     3
 6       Sysprv                3     5
 6       Downgrade             0     0
 6       Upgrade               0     0
 6       Impersonate           3     5

1.2 LEVELS Levels
Risk
Each of the privileges shown previously has been categorised into 7 levels (0-6).
These are in order of the 'damage' they are capable of doing to a system.
Actions
Users at levels 4 to 6 are considered to be dangerous and the number of such accounts should be strictly limited.
We would not expect to see more than about 7 accounts at these levels.
Results

 Number of users at each level:
   
 Level   Name               No.     %
 ------------------------------------
 0       None                0      0
 1       Normal              0      0
 2       Group               0      0
 3       Devour             48     76
 4       System              5      8
 5       Files               0      0
 6       All                10     16

1.3 FLAGS Flags
Risk
A section of the SYSUAF record details the flags set for each user. Flags, like privileges, limit the facilities available to a user. In general, they tend to prevent users doing certain actions or receiving certain information.
Actions
Examine the flags set for users and ensure that they are appropriate.
Results
 Number of users with the following flags set:
   
 Flag                     No.     %
 ----------------------------------
 NONE                      0      0
 Captive                  52     83
 Diswelcome                0      0
 Disnewmail                0      0
 Dismail                   4      6
 Genpwd                    0      0
 Disimage                  0      0
 Disreconnect              0      0
 Disreport                 0      0
 Disuser                   6     10
 Lockpwd                   4      6
 Ppwd_expired              0      0
 Restricted               47     75
 Dispwddic                61     97
 Defcli                    0      0
 Disctly                  48     76
 Audit                     2      3
 Autologon                 0      0
 Disforce_pwd_change       0      0
 Dispwdhis                 0      0
 Pwd2_expired              3      5
 ExtAuth                   0      0
 VMSAuth                   0      0
 PwdMix                    2      3
 DisPwdSynch               3      5

1.4 NETLI Network Logins
Risk
A NETWORK login is usually made to your system by a user doing a remote file access to it using DECNET. Many DCL commands specify a file or operation which can be performed across DECNET. They are non-interactive.
A BATCH login occurs when a user runs a batch job on the system using SUBMIT.
A LOCAL login is one that occurs from a terminal that is connected directly to the computer, or is on a Local Area Network and has CONNECT access to it. LOCAL logins are always interactive.
A DIALUP login is one that occurs from a terminal connected to a telephone line via a modem. If LOGINOUT sees that the line has the permanent characteristic /DIALUP, it automatically classifies the login as DIALUP. The most secure systems do not have ANY dial-up lines. If your system MUST have some form of dial-up, then VMS provides you with some security tools which counter someone trying to guess a password on your system over a dial-up line, and make dialling-in easier for authorised users.
A REMOTE login is made to your system by a remote user typing the command:
o $ SET HOST
This causes DECNET, to make a connection between them. If the node is reachable, the login sequence will be interactive.
Actions
Examine the numbers of users in each category and ensure that it is appropriate.
Dialup access is frequently given without good reason.
Results

 Number of users with different methods of access:
   
 Method                   No.     %
 ----------------------------------
 Network                  45     71
 Batch                    44     70
 Local                    47     75
 Dial-up                   0      0
 Remote                   44     70

 

 

 

2 PWDS Passwords
Risk
To list the users without passwords you need to issue this DCL instruction:
uaf/sel=password=''/display=(user)
This will list all users without passwords.

2.1 PWDLIFE Password life
Risk
The default length of time that a password is usable before it has to be changed.
EVERY account should have a password life set.
A password which is not changed frequently can become widely known.
Actions
We consider 90 days to be too long for most commercial systems and we would recommend 30 days.
Thus any passwords with a life of longer than 60 days should be changed immediately.
Results

 Distribution of password lifetimes.
 -----------------------------------
   
 Password never expires.
 -----------------------
 CXL_PJM                                      Never
 CXL_SYSTEM           GENERAL SYSTEM X        Never
 DEFAULT              GGM DEFAULT             Never
 GEN_PJM                                      Never
 GEN_SYSTEM           GENERAL SYSTEM          Never
 GGM_TRAIN1           TRAINING 1              Never
 SYSTEM               SYSTEM MANAGER          Never
 XGM_DEFAULT          XGM DEFAULT BT          Never
 XGM_TRAIN1           TRAINING 1X             Never
 Users in this range = 9 ( 14% )
   
 Password life greater than 301 days.
 ------------------------------------
 No users fall into this range.
   
 Password life between 151 and 300 days.
 ---------------------------------------
 CXL_JMM              J. MOLESON                235 days.
 Users in this range = 1 ( 2% )
   
 Password life between 91 and 150 days.
 --------------------------------------
 CXL_AFT                                         99 days.
 CXL_JMJC                                       135 days.
 CXL_PT               P.TELLY                   135 days.
 GEN_PM               DEP - P.SMITH              99 days.
 YGEN_PM              DEP - P.SMITH              99 days.
 ZEN_PM               DEP - P.SMITH              99 days.
 ZZN_PM               DEP - P.SMITH              99 days.
 Users in this range = 7 ( 11% )
   
 Password life between 61 and 90 days.
 -------------------------------------
 No users fall into this range.
   
 Password life between 31 and 60 days.
 -------------------------------------
 CXL_AGS                                         35 days.
 CXL_AJL                                         35 days.
 CXL_BG               DEP - B.GOLDS              35 days.
 CXL_BGL                                         35 days.
 CXL_BPB              B.P.BROWN                  35 days.
 CXL_JC               IBM - J.COOPER             35 days.
 CXL_JHM              J.H.MARTIN                 35 days.
 CXL_JLP              J. PETERS                  35 days.
 CXL_JMH              J. HOWELL                  35 days.
 CXL_JMI              J. IVY                     35 days.
 CXL_JML              J. LEADBETTER              35 days.
 CXL_JMN              J. NORTON                  35 days.
 CXL_JNM                                         35 days.
 CXL_JO               J.OXSHOT                   35 days.
 CXL_JPC              J.P.CROMPTON               35 days.
 CXL_JPJ                                         35 days.
 CXL_JPL              J. LENT                    35 days.
 CXL_JRD              J. ROVER                   35 days.
 CXL_JS               J.SMILEY                   35 days.
 CXL_JTH              J. HARRY                   35 days.
 CXL_MDM              M.D.MANTA                  35 days.
 CXL_MEZ              M.E.ZENT                   35 days.
 CXL_MJC              M.J.COLLINS                35 days.
 CXL_MKB              M.K.BROWN                  35 days.
 CXL_MLW              M.WEBSTER                  35 days.
 CXL_MNH              M.N.HUNTER                 35 days.
 CXL_NH               N.HOWELL                   35 days.
 CXL_PAC              P.A.CHIN                   35 days.
 CXL_PJR              FX2 - P.J.ROYCE            35 days.
 CXL_PM               FX1 - P.MOON               35 days.
 CXL_PRN                                         35 days.
 CXL_PRT              TNT_OPER2                  35 days.
 CXL_PS                                          35 days.
 CXL_RET              R.TAYLOR                   35 days.
 CXL_RH                                          35 days.
 CXL_RT               R.TULL                     35 days.
 Users in this range = 36 ( 57% )
   
 Password life of less than 31 days.
 -----------------------------------
 CXL_JMS              J. SMITH                   30 days.
 CXL_MC               DEP - M.COOL                0 days.
 CXL_NJM              N.J.MILTON                 20 days.
 FIELD                FIELD                      30 days.
 GEN_MC               DEP - M.COLLINS             0 days.
 Users in this range = 5 ( 8% )

2.2 PWDLIFESTD Password life vs. standards
Risk
Company standards are not being applied to these users.
We recommend that passwords for 'system' users should be set to 30 days or less and for 'ordinary' users, it should be set to 60 days or less.
Actions
Set password life times to your company standards.
Results
 The following 'system' users have password lifetimes below your company standards.
   
 User                                     Life   Std
 ---------------------------------------|------|-----
 CXL_AJL                                    35     30
 CXL_BPB          B.P.BROWN                 35     30
 CXL_JMJC                                  135     30
 CXL_JML          J. LEADBETTER             35     30
 CXL_JPJ                                    35     30
 CXL_JPL          J. LENT                   35     30
 CXL_MKB          M.K.BROWN                 35     30
 CXL_PJM                                  None     30
 CXL_PRN                                    35     30
 CXL_PRT          TNT_OPER2                 35     30
 CXL_RT           R.TULL                    35     30
 CXL_SYSTEM       GENERAL SYSTEM X        None     30
 GEN_PJM                                  None     30
 GEN_SYSTEM       GENERAL SYSTEM          None     30
 SYSTEM           SYSTEM MANAGER          None     30
  15'system' users do not have a password life of at least 30 days.
 
 The following 'ordinary' users have password lifetimes below your company standards.
   
 User                                     Life   Std
 ---------------------------------------|------|-----
 CXL_AFT                                    99     60
 CXL_JMM          J. MOLESON               235     60
 CXL_PT           P.TELLY                  135     60
 DEFAULT          GGM DEFAULT             None     60
 GEN_PM           DEP - P.SMITH             99     60
 GGM_TRAIN1       TRAINING 1              None     60
 XGM_DEFAULT      XGM DEFAULT BT          None     60
 XGM_TRAIN1       TRAINING 1X             None     60
 YGEN_PM          DEP - P.SMITH             99     60
 ZEN_PM           DEP - P.SMITH             99     60
 ZZN_PM           DEP - P.SMITH             99     60
  11'ordinary' users do not have a password life of at least 60 days.

2.3 PWDCHANGES Distribution of password changes
Risk
Detailed below are the times when the users' passwords were last changed.
A password may be set to PRE-EXPIRED and when a user first logs on they will be forced to change it. The system behaves as if the password had reached its expiration date.
A password which is not changed frequently can become widely known.
Actions
Any passwords which have not been changed for a long time either belong to accounts which have a long password expiry set (reduce it) or the account has not been used for a long time (delete it).
Results

 Distribution of password changes.
 ---------------------------------
   
 Password pre-expired.
 ---------------------
 CXL_AGS                                       Pre-expired
 CXL_AJL                                       Pre-expired
 CXL_BPB              B.P.BROWN                Pre-expired
 CXL_MNH              M.N.HUNTER               Pre-expired
 DEFAULT              GGM DEFAULT              Pre-expired
 XGM_DEFAULT          XGM DEFAULT BT           Pre-expired
 Users in this range = 6 ( 10% )
   
 Password changed more than 301 days.
 ------------------------------------
 No users fall into this range.
   
 Password changed between 151 and 300 days.
 ------------------------------------------
 CXL_BGL                                         297 days.
 CXL_JHM              J.H.MARTIN                 266 days.
 CXL_JPC              J.P.CROMPTON               251 days.
 CXL_MDM              M.D.MANTA                  239 days.
 CXL_MJC              M.J.COLLINS                192 days.
 CXL_MLW              M.WEBSTER                  152 days.
 CXL_RET              R.TAYLOR                   186 days.
 CXL_RH                                          153 days.
 GEN_PJM                                         166 days.
 Users in this range = 9 ( 14% )
   
 Password changed between 91 and 150 days.
 -----------------------------------------
 CXL_JMS              J. SMITH                   111 days.
 CXL_NH               N.HOWELL                   141 days.
 CXL_PJM                                         135 days.
 CXL_SYSTEM           GENERAL SYSTEM X           117 days.
 Users in this range = 4 ( 6% )
   
 Password changed between 61 and 90 days.
 ----------------------------------------
 CXL_AFT                                          64 days.
 CXL_BG               DEP - B.GOLDS               70 days.
 CXL_JC               IBM - J.COOPER              67 days.
 CXL_JML              J. LEADBETTER               64 days.
 CXL_JNM                                          64 days.
 CXL_JO               J.OXSHOT                    62 days.
 CXL_JPJ                                          69 days.
 CXL_MC               DEP - M.COOL                68 days.
 CXL_PS                                           64 days.
 CXL_RT               R.TULL                      69 days.
 GEN_MC               DEP - M.COLLINS             68 days.
 GEN_PM               DEP - P.SMITH               61 days.
 GEN_SYSTEM           GENERAL SYSTEM              86 days.
 GGM_TRAIN1           TRAINING 1                  61 days.
 SYSTEM               SYSTEM MANAGER              62 days.
 XGM_TRAIN1           TRAINING 1X                 61 days.
 ZEN_PM               DEP - P.SMITH               61 days.
 ZZN_PM               DEP - P.SMITH               61 days.
 Users in this range = 18 ( 29% )
   
 Password changed between 31 and 60 days.
 ----------------------------------------
 CXL_JLP              J. PETERS                   43 days.
 CXL_JMH              J. HOWELL                   43 days.
 CXL_JMI              J. IVY                      48 days.
 CXL_JMJC                                         55 days.
 CXL_JMM              J. MOLESON                  43 days.
 CXL_JMN              J. NORTON                   48 days.
 CXL_JPL              J. LENT                     46 days.
 CXL_JRD              J. ROVER                    49 days.
 CXL_JS               J.SMILEY                    48 days.
 CXL_JTH              J. HARRY                    54 days.
 CXL_MEZ              M.E.ZENT                    55 days.
 CXL_MKB              M.K.BROWN                   55 days.
 CXL_NJM              N.J.MILTON                  56 days.
 CXL_PAC              P.A.CHIN                    49 days.
 CXL_PJR              FX2 - P.J.ROYCE             48 days.
 CXL_PM               FX1 - P.MOON                49 days.
 CXL_PRN                                          54 days.
 CXL_PRT              TNT_OPER2                   55 days.
 CXL_PT               P.TELLY                     56 days.
 FIELD                FIELD                       48 days.
 Users in this range = 20 ( 32% )
   
 Password changed of less than 31 days.
 --------------------------------------
 YGEN_PM              DEP - P.SMITH                0 days.
 Users in this range = 1 ( 2% )

2.4 PWDLEN Password length
Risk
This is the minimum length required for a user's password.
Short passwords are easy to guess.
Actions
We recommend that passwords are at least 6 characters in length. Any shorter and they become too easy to guess. Much past 8 characters and users will tend to write them down. You may consider it beneficial for 'system' accounts to have passwords of at least 8 characters.
Results
   
 Users with min. password length= 0
 CXL_MC        DEFAULT       GEN_MC        XGM_DEFAULT
  4 users.
 
   
 Users with min. password length= 2
 CXL_JTH       GEN_PM
  2 users.
 
   
 Users with min. password length= 3
 CXL_JMM       CXL_SYSTEM    GEN_SYSTEM
  3 users.
 
   
 Users with min. password length= 6
 CXL_AFT       CXL_AGS       CXL_AJL       CXL_BG        CXL_BGL
 CXL_BPB       CXL_JC        CXL_JHM       CXL_JLP       CXL_JMH
 CXL_JMI       CXL_JMJC      CXL_JML       CXL_JMN       CXL_JMS
 CXL_JNM       CXL_JPC       CXL_JPJ       CXL_JPL       CXL_JRD
 CXL_JS        CXL_MDM       CXL_MEZ       CXL_MJC       CXL_MKB
 CXL_MLW       CXL_MNH       CXL_NH        CXL_NJM       CXL_PAC
 CXL_PJM       CXL_PJR       CXL_PM        CXL_PRN       CXL_PRT
 CXL_PS        CXL_PT        CXL_RET       CXL_RH        CXL_RT
 FIELD         GEN_PJM       GGM_TRAIN1    XGM_TRAIN1
  44 users.
 
   
 Users with min. password length= 8
 SYSTEM
  1 users.
 
   
 Users with min. password length= 9
 YGEN_PM       ZEN_PM        ZZN_PM
  3 users.
 
   
 Users with min. password length= 44
 CXL_JO
  1 users.

2.5 PWDLENSTD Password length vs. standards
Risk
Shown here are users with passwords below your company standards.
Actions
We recommend that passwords are at least 6 characters in length. Any shorter and they become too easy to guess.
Longer than 8 characters and 'ordinary'users will tend to write them down.
You may consider it beneficial for 'system' accounts to have passwords of at least 8 characters.
Results
 The following 'system' users have password lifetimes below your company standards.
   
 User                                     Life   Std
 ---------------------------------------|------|-----
 CXL_AJL                                     6      8
 CXL_BPB          B.P.BROWN                  6      8
 CXL_JMJC                                    6      8
 CXL_JML          J. LEADBETTER              6      8
 CXL_JPJ                                     6      8
 CXL_JPL          J. LENT                    6      8
 CXL_MC           DEP - M.COOL               0      8
 CXL_MKB          M.K.BROWN                  6      8
 CXL_NJM          N.J.MILTON                 6      8
 CXL_PJM                                     6      8
 CXL_PRN                                     6      8
 CXL_PRT          TNT_OPER2                  6      8
 CXL_RT           R.TULL                     6      8
 CXL_SYSTEM       GENERAL SYSTEM X           3      8
 FIELD            FIELD                      6      8
 GEN_MC           DEP - M.COLLINS            0      8
 GEN_PJM                                     6      8
 GEN_SYSTEM       GENERAL SYSTEM             3      8
  18'system' users do not have a password length of at least 8 chrs.
 
 The following 'ordinary' users have password length below your company standards.
   
 User                                     Len    Std
 ---------------------------------------|------|-----
 CXL_JMM          J. MOLESON                 3      6
 CXL_JTH          J. HARRY                   2      6
 DEFAULT          GGM DEFAULT                0      6
 GEN_PM           DEP - P.SMITH              2      6
 XGM_DEFAULT      XGM DEFAULT BT             0      6
  5'ordinary' users do not have a password length of at least 6 chrs.

 

 

 

3 A/C Accounts
Risk
This section reviews the users' accounts for specific problems. Problems may be trivial in themselves but when combined with some of the other problems or facilities available to a user, may become very significant.

3.1 UNA/C Unused accounts
Risk
The following accounts have never been used.
Unused accounts represent a security risk, particularly if a default password has been assigned to them, pending a change by the legitimate user.
Someone else may gain access before the real user if the initial password assigned to the account is a standard format (e.g. user's surname).
Actions
Determine whether they are new accounts or the users have just never signed on to them.
Results
 Users with unused accounts:

 CXL_SYSTEM          GENERAL SYSTEM X     | DEFAULT             GGM DEFAULT
 GEN_PM              DEP - P.SMITH        | GEN_SYSTEM          GENERAL SYSTEM
 GGM_TRAIN1          TRAINING 1           | XGM_DEFAULT         XGM DEFAULT BT
 XGM_TRAIN1          TRAINING 1X          | YGEN_PM             DEP - P.SMITH
 ZEN_PM              DEP - P.SMITH        | ZZN_PM              DEP - P.SMITH
 
 10 users.

3.2 NOOWN No owners
Risk
A user has not been defined for these accounts.
Any actions performed by these accounts may not be able to be traced back to a particular person.
Actions
Every account should have an owner, someone who is responsible for the actions of whoever signs on with that user-ID. When a problem arises then hopefully the System Manager will be able to question the user. Often, it is not possible to identify a specific terminal or a user-ID and so a name is vital. Some companies also include in this field the telephone extension of the user or their payroll number. These help in both locating a user quickly and identifying a user explicitly.
Results
 The following accounts do not have owners.
 
 CXL_AFT              | CXL_AGS              | CXL_AJL
 CXL_BGL              | CXL_JMJC             | CXL_JNM
 CXL_JPJ              | CXL_PJM              | CXL_PRN
 CXL_PS               | CXL_RH               | GEN_PJM
 12 users.

 

 

 

4 SPAC Specific accounts
Risk
In this section we review in detail the accounts of certain standard 'system' users which appear on all similar systems. These include SYSTEM, FIELD and DEFAULT. Each has a purpose and can also be copied to make other accounts with different names but similar properties.
Every hacker knows that these accounts exist and also that some of them are the most powerful on the system. For that reason we have chosen to pay particular attention to them in this section.
Any hacker using a terminal can enter a user name of SYSTEM or FIELD and be almost certain that there is an account on the system with that name. They then only have to determine the password which should be a difficult job.
However, if these accounts are DISUSERED then even with the correct password he could not enter the system.
Full details are given for each account followed by a list of identified problems.
If these accounts are not shown in the following pages, they were not found in your SYSUAF file and this is unusual and needs investigating.

4.1 AC-SYSTEM SYSTEM Account
Risk
This is the main Systems Manager account. His own account can be used to re-establish it when needed.
Actions carried out by the SYSMAN account could have been performed by every person who knows the password.
Actions
The system manager should produce his own NAMED account which is used for day-to-day work and reserve this account for special occasions.
Most managers can work perfectly well with an account which has SYSPRV and they should disuser this account.
Results
 System   SYSTEM MANAGER 

 UIC:1,4
 Password length: 8                  Password lifetime: Never expires
 Password last changed: 62 days.
 Account expiry: None
 Last interactive login: 62 days.    Last non-interactive login: 60 days.
 Connections: None.
   
 Privileges:
  Mount Netmbx Tmpmbx Group Grpprv Acnt Allspool Exquota Grpnam Prmceb
  Prmmbx Shmem Altpri Oper Pswapm Security Syslck World Diagnose Volpro
  Bypass Cmexec Cmkrnl Detach Log_IO Pfnmap Phy_IO Readall Setprv Share
  Sysnam Sysprv
   
 Flags:
  Dispwddic

4.2 AC-FIELD FIELD Account
Risk
The FIELD account is used by service engineers when they call to do routine maintenance or in an emergency.
Since most systems have this account a hacker will try to guess this password and if they succeed, will have full control of your system. If it is DISUSERED then even guessing the password will not permit access. Try to ensure that the password has not been left as FIELD.
Actions
This account should be left as DISUSERed until the engineer calls.
Results
 Field   FIELD 

 UIC:100,0
 Password length: 6                  Password lifetime: 30 days.
 Password last changed: 48 days.
 Account expiry: 7 days.
 Last interactive login: Never       Last non-interactive login: 43 days.
 Connections: None.
   
 Privileges:
  Netmbx Tmpmbx Group Grpnam Prmceb Prmmbx Altpri Oper Security World Volpro
  Bypass Cmkrnl Log_IO Phy_IO Readall Setprv Sysnam Sysprv
   
 Flags:
  Dispwddic

4.3 AC-DEFAULT DEFAULT Account
Risk
This account is often used as a template to create new users from. Instead of having to define all the settings for a user, this account is used as a basis and then copied and modified slightly to create a new user account.
The privileges on this account could be increased thus affecting all users subsequently created.
Actions
This account should be set up to have the minimum privileges available to a normal user (probably just TMPMBX).
Results
 Default   GGM DEFAULT 

 UIC:100,30
 Password length: 0                  Password lifetime: Never expires
 Password last changed:Pre-expired
 Account expiry: None
 Last interactive login: Never       Last non-interactive login: Never
 Connections: None.
   
 Privileges:
  Netmbx Tmpmbx Group Grpnam
   
 Flags:
  Captive Dismail Restricted Dispwddic Disctly

 

 

 

5 LOGINS Logins
Risk
This section details how users connect to the system.

5.1 LINOI Non-interactive Logins
Risk
NON-INTERACTIVE Logins require no input from the user during the login, even though LOGINOUT still runs. These logins can be made by typing the SPAWN command or by using DECNET between network nodes.
A SUBPROCESS login occurs when a user types the DCL command RUN with any qualifiers other than /DEBUG, /DETACH or /UIC, the DCL command SPAWN, or runs a program which contains either the system routine LIB$SPAWN or $CREPRC. A SUBPROCESS login is always non-interactive.
Actions
Most normal application users will not need to login non-interactively. Examines the users shown below and decide if they have appropriate access to the system.
Results
 The following users have logged in non-interactively:
   
 CXL_PM               | FIELD
 2 users.

5.2 LIBOT Both types of login
Risk
Users generally login either interactively or non-interactively. It is usually only IT staff who use both methods.
Actions
We would suggest that you review the users shown below and ensure that they are all legitimate IT users.
Results
 The following users have logged in interactively AND non-interactively:
   
 CXL_JMJC             | CXL_MC               | CXL_RT
 GEN_MC               | SYSTEM
 5 users.

5.3 LIINT Interactive logins
Risk
With INTERACTIVE Logins there is some communication between the program LOGINOUT.EXE and the user. The user provides LOGINOUT with responses to the 'Username' and 'Password' prompts, and, depending on the answers received, LOGINOUT will either grant or deny access to VMS.
Actions
This is not a high-risk issue and most users will have interactive logins. It is shown here for completeness.
Results
 Of the 63 users, 45 have logged in interactively (ie from a terminal).
 This is perfectly normal but we would suggest that you review the
 non-interactive users too.

5.4 LLOGINS Last logins
Risk
Shown below are when users last logged in by any means. If the system is actively in use then most should have done so in the last 30 days. Those accounts which have not logged in for several months may no longer be needed and should be deleted by first issuing a written warning to the user.
Lots of unused accounts may indicate that when users are leaving or moving jobs, no one is informing the IT department or User Administration department.
Users who have left the company could still gain unauthorised access.
Actions
A 'leavers procedure' should be established and anyone leaving the company should have their account deleted IMMEDIATELY.
Review any accounts older than 60 days.
Results
 You consider 'old' accounts to be those which have not been used for more
 than 90 days for ordinary users and 50 days for 'system' users.
 This review showed that there were 0 such accounts.

 We suggest that you consider designating 'old' accounts to be those which
 have not been used for more than 60 days.

 Distribution of last logins.
 ----------------------------
 
 Users who have never logged in.
 
 Last login between 151 and 300 days.
 CXL_JPC             J.P.CROMPTON                255
 
 Last login between 61 and 90 days.
 CXL_AGS                                          64
 CXL_BG              DEP - B.GOLDS                70
 CXL_BPB             B.P.BROWN                    64
 CXL_JC              IBM - J.COOPER               63
 CXL_MC              DEP - M.COOL                 68
 CXL_MNH             M.N.HUNTER                   70
 GEN_MC              DEP - M.COLLINS              68
 
 Last login between 31 and 60 days.
 CXL_AFT                                          43
 CXL_AJL                                          53
 CXL_BGL                                          46
 CXL_JHM             J.H.MARTIN                   43
 CXL_JLP             J. PETERS                    43
 CXL_JMH             J. HOWELL                    43
 CXL_JMI             J. IVY                       46
 CXL_JMJC                                         43
 CXL_JML             J. LEADBETTER                56
 CXL_JMM             J. MOLESON                   43
 CXL_JMN             J. NORTON                    46
 CXL_JMS             J. SMITH                     43
 CXL_JNM                                          48
 CXL_JO              J.OXSHOT                     43
 CXL_JPJ                                          46
 CXL_JPL             J. LENT                      43
 CXL_JRD             J. ROVER                     43
 CXL_JS              J.SMILEY                     46
 CXL_JTH             J. HARRY                     50
 CXL_MDM             M.D.MANTA                    43
 CXL_MEZ             M.E.ZENT                     43
 CXL_MJC             M.J.COLLINS                  43
 CXL_MKB             M.K.BROWN                    43
 CXL_MLW             M.WEBSTER                    43
 CXL_NH              N.HOWELL                     43
 CXL_NJM             N.J.MILTON                   43
 CXL_PAC             P.A.CHIN                     47
 CXL_PJM                                          43
 CXL_PJR             FX2 - P.J.ROYCE              43
 CXL_PM              FX1 - P.MOON                 43
 CXL_PRN                                          43
 CXL_PRT             TNT_OPER2                    43
 CXL_PS                                           43
 CXL_PT              P.TELLY                      43
 CXL_RET             R.TAYLOR                     43
 CXL_RH                                           43
 CXL_RT              R.TULL                       43
 FIELD               FIELD                        43
 GEN_PJM                                          43
 SYSTEM              SYSTEM MANAGER               60

5.5 LIFAIL Login failures
Risk
A high number of login failure attempts indicates that:
o you have a forgetful user
o a process is trying to connect unsuccessfully
o the account is under attack from someone guessing passwords
Actions
You may care to discuss a sample of these with the users concerned.
A very high number of failures may indicate a failing program or batch job.
Remember, an account with NO login failures may mean a hacker has succeeded.
Results
 The following users have had login failures:

 User-ID          Owner                    Fails   Last used
 -----------------------------------------------------------
 CXL_AGS                                      12          64
 CXL_BPB          B.P.BROWN                    3          64
 CXL_JMH          J. HOWELL                  126          43
 CXL_JMJC                                     30          43
 CXL_MC           DEP - M.COOL                 9          68
 CXL_PJM                                     100          43
 CXL_RT           R.TULL                       6          43
 CXL_SYSTEM       GENERAL SYSTEM X            20       Never
 GEN_MC           DEP - M.COLLINS              9          68
 GEN_PJM                                     100          43
 GEN_PM           DEP - P.SMITH               17       Never
 GEN_SYSTEM       GENERAL SYSTEM              20       Never
 YGEN_PM          DEP - P.SMITH               22       Never
 ZEN_PM           DEP - P.SMITH               22       Never
 ZZN_PM           DEP - P.SMITH               22       Never

5.6 DEFDIR Default Directories
Risk
Default directories are the initial storage areas assigned to users.
Where people share directories they will also share data and the idea of accountability is destroyed.
Actions
Ensure that users do not share default directories.
Results
 The following users do no have a default directory set:
 CXL_JHM              J.H.MARTIN
 CXL_JMJC
 CXL_MC               DEP - M.COOL
 CXL_PJR              FX2 - P.J.ROYCE
 GEN_MC               DEP - M.COLLINS
   
  5 users.

5.7 CLI CLI
Risk
The Command Line Interpreter (CLI) is used to enter commands directly to the system. It is a standard product but others can be specified.
This is a standard product which is well known and any other CLI may behave in an unpredictable manner. It may even have malicious purposes.
Actions
The CLI specified in user records should be the standard one supplied with the system.
Results
 42 accounts use the standard CLI called DCL and 21 accounts do not.
   
 CLI = DCL
 CXL_AJL
   
 CLI = DCL2
 CXL_JLP              J. PETERS
   
 CLI = No CLI
 CXL_JMH              J. HOWELL
   
 CLI = No CLI
 CXL_JO               J.OXSHOT
   
 CLI = No CLI
 CXL_JPJ
   
 CLI = DCLX
 CXL_MC               DEP - M.COOL
   
 CLI = DCL2
 CXL_MJC              M.J.COLLINS
   
 CLI = DCL2
 CXL_MKB              M.K.BROWN
   
 CLI = DCL2
 CXL_MNH              M.N.HUNTER
   
 CLI = DCL2
 CXL_NH               N.HOWELL
   
 CLI = DCL2
 CXL_NJM              N.J.MILTON
   
 CLI = DCLY
 CXL_PJM
   
 CLI = No CLI
 DEFAULT              GGM DEFAULT
   
 CLI = DCLX
 GEN_MC               DEP - M.COLLINS
   
 CLI = DCLY
 GEN_PJM
   
 CLI = DCL2
 GGM_TRAIN1           TRAINING 1
   
 CLI = No CLI
 XGM_DEFAULT          XGM DEFAULT BT
   
 CLI = DCL2
 XGM_TRAIN1           TRAINING 1X
   
 CLI = DCL3
 YGEN_PM              DEP - P.SMITH
   
 CLI = DCL3
 ZEN_PM               DEP - P.SMITH
   
 CLI = DCL3
 ZZN_PM               DEP - P.SMITH

5.8 LGICMD LGICMD
Risk
LGICMD is the name of a special file which is executed whenever a user gains access to the system.
A malicious user with access to another user's User File Directory (UFD) could copy another LOGIN.COM which contained a time-bomb or Trojan horse.
Actions
It is best if these files are not called LOGIN or LOGIN.COM. A user without a LGICMD file is in a similar position.
Results
 The following users have bad LGICMDs:

   
 CXL_AGS                                    LOGIN.COM
 CXL_BGL                                    No LGICMD
 CXL_JC               IBM - J.COOPER        No LGICMD
 CXL_JNM                                    No LGICMD
 CXL_JPC              J.P.CROMPTON          No LGICMD
 CXL_JS               J.SMILEY              No LGICMD
 CXL_MC               DEP - M.COOL          LOGIN
 FIELD                FIELD                 No LGICMD
 GEN_MC               DEP - M.COLLINS       LOGIN
 GGM_TRAIN1           TRAINING 1            No LGICMD
 SYSTEM               SYSTEM MANAGER        LOGIN
 XGM_TRAIN1           TRAINING 1X           No LGICMD

5.9 NCAPTIVE Non-Captive
Risk
An account which is CAPTIVE cannot gain access to the operating system and so cannot use DCL commands directly.
Access to the command line could let a user do serious damage to the system.
Actions
Most users should be CAPTIVE and you ought to investigate those listed below. They may be system accounts or development staff but you should satisfy yourself that each one HAS to be non-CAPTIVE.
A CAPTIVE user will normally run an application program and then will be logged out when they are finished. Even when a user is CAPTIVE them may still modify files using an application such as a WP or spreadsheet so make sure you know which applications CAPTIVE users can run.
Results
 Accounts which are not captive:

   
 CXL_AJL                              | CXL_BPB         B.P.BROWN
 CXL_MC          DEP - M.COOL         | CXL_PJM
 CXL_SYSTEM      GENERAL SYSTEM X     | FIELD           FIELD
 GEN_MC          DEP - M.COLLINS      | GEN_PJM
 GEN_SYSTEM      GENERAL SYSTEM       | SYSTEM          SYSTEM MANAGER

 

 

 

6 UICS UICs
Risk
User Identification Codes (UICs) determine a users rights on the system.

6.1 SHUICS Shared UICs
Risk
These accounts share User Identification Codes (UICs).
Users who have a common UIC will have access to each others data and the file protection scheme may not work as intended.
Actions
Ensure that all users have unique UICs.
Results
 The same UICs are shared by the following users:
 
UIC 100,10:-
  CXL_AFT             CXL_AJL             CXL_BG              CXL_BGL
   CXL_BPB             CXL_JC              CXL_JHM             CXL_JLP
   CXL_JMH             CXL_JMI             CXL_JML             CXL_JMM
   CXL_JMS             CXL_JNM             CXL_JO              CXL_JPC
   CXL_JRD             CXL_JS              CXL_JTH             GEN_PM
   YGEN_PM             ZEN_PM              ZZN_PM
 
UIC ?,?:-
  CXL_AGS             CXL_JMN
 
UIC 7,10:-
  CXL_JMJC            CXL_MC
 
UIC 1,10:-
  CXL_JPJ             CXL_NJM
 
UIC 2,10:-
  CXL_JPL             CXL_PRN             CXL_RT              GEN_MC
 
UIC 200,10:-
  CXL_MDM             CXL_MEZ             CXL_MJC             CXL_MKB
   CXL_MLW             CXL_MNH             CXL_NH              CXL_PAC
   CXL_PJR             CXL_PM              CXL_PRT             CXL_PS
   CXL_PT              CXL_RET             CXL_RH
 
UIC 5,0:-
  CXL_PJM             GEN_PJM
 
UIC 100,30:-
  DEFAULT             GGM_TRAIN1          XGM_DEFAULT         XGM_TRAIN1

6.2 LOWUICS Low value UICs
Risk
These accounts all have low group numbers in their UIC. The UIC is in the format [group,member]. Usually, group numbers of 10 (octal) and less fall into the category of SYSTEM and effectively are the same as users with SYSPRV.
These users thus have the potential to completely control the system. Only operators and system managers should have these UICs.
Actions
Examine users with low UICs and ensure that these are appropriate.
Results
 The following users have system UICs:
   
 CXL_JMJC                                  [7,10]
 CXL_JPJ                                   [1,10]
 CXL_JPL         J. LENT                   [2,10]
 CXL_MC          DEP - M.COOL              [7,10]
 CXL_NJM         N.J.MILTON                [1,10]
 CXL_PJM                                   [5,0]
 CXL_PRN                                   [2,10]
 CXL_RT          R.TULL                    [2,10]
 CXL_SYSTEM      GENERAL SYSTEM X          [3,0]
 GEN_MC          DEP - M.COLLINS           [2,10]
 GEN_PJM                                   [5,0]
 GEN_SYSTEM      GENERAL SYSTEM            [7,0]
 SYSTEM          SYSTEM MANAGER            [1,4]
  13 users have system UICs.

 

 

 

7 SYSSET System settings
Risk
This section looks at system settings.

7.1 UNLCPU Unlimited cpu
Risk
These users do not have their CPU time restricted.
A user performing an unusual task can 'grab' most of the CPU time and make the performance of the system become unusable for everyone else.
Actions
Every user should have some form of CPU limit set. This is often felt to be difficult to do by System Managers but with careful monitoring of the systems, a reasonable limit can be established.
A good starting point might be 10 hours and work down from there.
Results
 No users have unlimited CPU usage.