Source-derived document; review findings and open questions with the application owner.

Security and Trust Boundaries

Scope

The evidence describes a partially reconstructed CardDemo mainframe using CICS, BMS, VSAM, DB2, IMS, MQ, JCL, REXX, and related utilities. It establishes artifacts and intended behavior, not successful execution, complete topology, compiler semantics, sequencing, or production behavior. E0001 E0010 E0017 E0020 E0021

Observed Security Controls and Actors

Security-related artifacts include the `USRSEC` data store, RACF, and `DUSRSECJ`. Identified actors include regular users, administrators, operators, and a Control-M scheduler environment on UNIX at `MY-HOST`; ownership, permissions, and enforcement are not established. E0016 E0032 E0033 E0026 E0028 E0035 E0036 E0044 E0047

The login transaction is `CC00`, which invokes `COSGN00C`. Validated `ADMIN` credentials are routed by `XCTL` to `COADM01C`, while validated non-`ADMIN` credentials are routed to `COMEN01C`. This routing is described as intended behavior; successful runtime enforcement is unverified. E0034 E0038 E0023 E0045

User-security maintenance is represented by flows that add records to `USRSEC`, read and rewrite records, and read and delete records. These observations establish data-manipulation paths, but not whether authorization, approval, audit, or segregation-of-duties controls protect them. E0017 E0016 E0036

Trust-Boundary Areas

Inference: Authentication and role-based routing appear to form a boundary between unauthenticated callers and online functions, with a further distinction between administrative and non-administrative paths. The evidence does not establish session protection, credential storage, lockout, privilege enforcement, or bypass resistance. E0034 E0038 E0032 E0033 E0036

Inference: CICS transactions, commareas, `XCTL`, BMS screens, and connected programs appear to form an application boundary around account, payment, inquiry, maintenance, reporting, and security functions. Interface contracts, validation coverage, caller identity propagation, and runtime compatibility remain unresolved. E0001 E0003 E0029 E0034 E0038 E0039

Inference: VSAM, DB2, IMS, MQ, TDQs, batch jobs, FTP, and reporting tools represent additional trust-boundary areas because data and commands cross between application, storage, messaging, scheduling, and external environments. The evidence does not establish queue permissions, network boundaries, keys, transformations, or ownership. E0003 E0004 E0010 E0022 E0025 E0039 E0040 E0042 E0046

Security Hazards

Literal or example credentials and sensitive-looking fields occur in the evidence. Encryption, masking, secrets management, audit logging, transport protection, and exposure controls are unknown. E0032 E0033 E0036

Potential hazards include exposed credentials, unauthorized administrative access, destructive security-data changes, malformed input, duplicate identifiers, partial updates, FTP failure, abends, and uncertain atomicity. No security incident is established. E0014 E0017 E0018 E0026 E0037 E0040 E0042 E0045

Unknowns

Unknown: The supplied evidence does not establish complete trust-boundary topology, control ownership, authorization enforcement, identity propagation, cryptographic protections, audit requirements, queue or dataset permissions, network segmentation, recovery guarantees, or production suitability. E0009 E0018 E0036 E0039 E0045 E0047