STIGQter: STIG Summary: IBM DB2 V10.5 LUW Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 25 Oct 2019:

DB2 must use NIST FIPS 140-2 validated cryptographic modules for cryptographic operations.

DISA Rule

SV-89167r1_rule

Vulnerability Number

V-74493

Group Title

SRG-APP-000179-DB-000114

Rule Version

DB2X-00-004600

Severity

CAT I

CCI(s)

• CCI-000803 - The information system implements mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.

Weight

10

Fix Recommendation

Modify the cryptographic configuration to employ SSL/TLS for encryption of communications.

Modify the cryptographic configuration to employ IBM Database Native Encryption for encryption of data at rest.

Check Contents

If it has been determined that encryption is not required, this is not a finding.

Review the cryptographic configuration.

If SSL/TLS is not specified for encryption of communications, this is a finding. See below for more detailed instructions.

If IBM Database Native Encryption is not specified for encryption of data at rest, this is a finding. See below for more detailed instructions.

To Verify SSL is in use:
Check the DB2 registry variable DB2COMM to include SSL.

$db2 set all

If DB2COMM does not include SSL, this is a finding.

Find the value of SSL_VERSIONS by running:

$db2 get dbm cfg

If SSL_VERSIONS is not set to TLSV12, this is a finding.

Find the value of SSL_CIPHERSPECS by running:

$db2 get dbm cfg

If SSL_CIPHERSPECS is not set to a symmetric algorithm key length that is greater than or equal to 112, this is a finding.

Find the value of SSL_SVC_LABEL by running:

$db2 get dbm cfg

If the parameter SSL_SVC_LABEL is not set to a certificate with RSA key length that is greater than or equal to 2048, this is a finding.

If the certificate does not have a digital signature with minimum SHA2, this is a finding.

The above settings ensure that all connections over SSL in any CLP or Java application strictly adhere to NIST SP 800-131A.

To Verify DB2 native encryption is being used run the following SQL Query:
DB2> SELECT SUBSTR(object_name,1,8) AS NAME, SUBSTR(object_type,1,8) TYPE, SUBSTR(algorithm,1,8) ALGORITHM
FROM TABLE(sysproc.admin_get_encryption_info())

If value of Algorithm is NULL for the database, this is a finding.

If the database is not encrypted with native encryption or any third-party tool, this is a finding.

Vulnerability Number

V-74493

Documentable

False

Rule Version

DB2X-00-004600

Severity Override Guidance

If it has been determined that encryption is not required, this is not a finding.

Review the cryptographic configuration.

If SSL/TLS is not specified for encryption of communications, this is a finding. See below for more detailed instructions.

If IBM Database Native Encryption is not specified for encryption of data at rest, this is a finding. See below for more detailed instructions.

To Verify SSL is in use:
Check the DB2 registry variable DB2COMM to include SSL.

$db2 set all

If DB2COMM does not include SSL, this is a finding.

Find the value of SSL_VERSIONS by running:

$db2 get dbm cfg

If SSL_VERSIONS is not set to TLSV12, this is a finding.

Find the value of SSL_CIPHERSPECS by running:

$db2 get dbm cfg

If SSL_CIPHERSPECS is not set to a symmetric algorithm key length that is greater than or equal to 112, this is a finding.

Find the value of SSL_SVC_LABEL by running:

$db2 get dbm cfg

If the parameter SSL_SVC_LABEL is not set to a certificate with RSA key length that is greater than or equal to 2048, this is a finding.

If the certificate does not have a digital signature with minimum SHA2, this is a finding.

The above settings ensure that all connections over SSL in any CLP or Java application strictly adhere to NIST SP 800-131A.

To Verify DB2 native encryption is being used run the following SQL Query:
DB2> SELECT SUBSTR(object_name,1,8) AS NAME, SUBSTR(object_type,1,8) TYPE, SUBSTR(algorithm,1,8) ALGORITHM
FROM TABLE(sysproc.admin_get_encryption_info())

If value of Algorithm is NULL for the database, this is a finding.

If the database is not encrypted with native encryption or any third-party tool, this is a finding.

Check Content Reference

M

Target Key

3161

Comments