STIGQter: STIG Summary: IBM DB2 V10.5 LUW Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 25 Oct 2019:

The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to DB2, etc.) must be restricted to authorized users.

DISA Rule

SV-89149r1_rule

Vulnerability Number

V-74475

Group Title

SRG-APP-000133-DB-000362

Rule Version

DB2X-00-003300

Severity

CAT II

CCI(s)

• CCI-001499 - The organization limits privileges to change software resident within software libraries.

Weight

10

Fix Recommendation

Use the appropriate variation of the REVOKE command to revoke the privileges from non-qualified and non-authorized individuals:
DB2> REVOKE

Notes: Information about each database is automatically maintained in a set of views called the system catalog which is created when the database is created. This system catalog describes tables, columns, indexes, programs, privileges, and other objects.

information on the system catalog is available in the IBM knowledge base:

http://www-01.ibm.com/support/knowledgecenter/SSEPGG_10.5.0/com.ibm.db2.luw.admin.sec.doc/doc/c0005478.html?lang=en

http://www-01.ibm.com/support/knowledgecenter/SSEPGG_10.5.0/com.ibm.db2.luw.admin.sec.doc/doc/c0005817.html

Check Contents

Get the list of qualified and authorized owners from ISSO or DBA.

The following view list information about privileges held by the users, the identities of users granting privileges, and the object ownership:
DB2> SELECT * FROM SYSIBMADM.PRIVILEGES

If any of the privileges is held by non-qualified and non-authorized individuals, this is a finding.

Vulnerability Number

V-74475

Documentable

False

Rule Version

DB2X-00-003300

Severity Override Guidance

Get the list of qualified and authorized owners from ISSO or DBA.

The following view list information about privileges held by the users, the identities of users granting privileges, and the object ownership:
DB2> SELECT * FROM SYSIBMADM.PRIVILEGES

If any of the privileges is held by non-qualified and non-authorized individuals, this is a finding.

Check Content Reference

M

Target Key

3161

Comments