DB2X-00-000300 - DB2 must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals - config file

800-53|IA-2

CAT|II

CCI|CCI-000015

Rule-ID|SV-89105r1_rule

STIG-ID|DB2X-00-000300

Vuln-ID|V-74431

DB2X-00-002200 - The audit information produced by DB2 must be protected from unauthorized read access - ownership

800-53|CM-6

CCI|CCI-000162

CSCv6|3.1

Rule-ID|SV-89127r1_rule

STIG-ID|DB2X-00-002200

Vuln-ID|V-74453

DB2X-00-002200 - The audit information produced by DB2 must be protected from unauthorized read access - verify setting

800-53|AU-9

DB2X-00-002300 - The audit information produced by DB2 must be protected from unauthorized modification - ownership

CCI|CCI-000163

Rule-ID|SV-89129r1_rule

STIG-ID|DB2X-00-002300

Vuln-ID|V-74455

DB2X-00-002300 - The audit information produced by DB2 must be protected from unauthorized modification - verify setting

DB2X-00-002400 - The audit information produced by DB2 must be protected from unauthorized deletion - ownership

CCI|CCI-000164

Rule-ID|SV-89131r1_rule

STIG-ID|DB2X-00-002400

Vuln-ID|V-74457

DB2X-00-002400 - The audit information produced by DB2 must be protected from unauthorized deletion - verify setting

DB2X-00-002900 - The OS must limit privileges to change the DB2 software resident within software libraries (including privileged programs) - INSTALL

800-53|AC-6

CCI|CCI-001499

Rule-ID|SV-89141r1_rule

STIG-ID|DB2X-00-002900

Vuln-ID|V-74467

DB2X-00-002900 - The OS must limit privileges to change the DB2 software resident within software libraries (including privileged programs) - INSTANCE

DB2X-00-003100 - Database software, including DBMS configuration files, must be stored in dedicated directories, separate from the host OS and other applications - INSTALL

Rule-ID|SV-89145r1_rule

STIG-ID|DB2X-00-003100

Vuln-ID|V-74471

DB2X-00-003100 - Database software, including DBMS configuration files, must be stored in dedicated directories, separate from the host OS and other applications - INSTANCE

DB2X-00-003400 - Default demonstration and sample databases, database objects, and applications must be removed.

800-53|CM-7

CCI|CCI-000381

Rule-ID|SV-89151r1_rule

STIG-ID|DB2X-00-003400

Vuln-ID|V-74477

DB2X-00-003500 - Unused database components, DBMS software, and database objects must be removed.

Rule-ID|SV-89153r1_rule

STIG-ID|DB2X-00-003500

Vuln-ID|V-74479

DB2X-00-003800 - DB2 must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments - SSL_SVCENAME

CCI|CCI-000382

Rule-ID|SV-89159r2_rule

STIG-ID|DB2X-00-003800

Vuln-ID|V-74485

DB2X-00-003800 - DB2 must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments - SVCENAME

DB2X-00-003800 - DB2 must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.

DB2X-00-004100 - If passwords are used for authentication, DB2 must transmit only encrypted representations of passwords - AUTHENTICATION

800-53|IA-5(1)

CCI|CCI-000197

Rule-ID|SV-89161r2_rule

STIG-ID|DB2X-00-004100

Vuln-ID|V-74487

DB2X-00-004100 - If passwords are used for authentication, DB2 must transmit only encrypted representations of passwords - DB2AUTH

DB2X-00-004600 - DB2 must use NIST FIPS 140-2 validated cryptographic modules for cryptographic operations - DB2COMM

800-53|SC-13

CAT|I

CCI|CCI-000803

Rule-ID|SV-89167r1_rule

STIG-ID|DB2X-00-004600

Vuln-ID|V-74493

DB2X-00-005100 - DB2 must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values - SSL

CCI|CCI-001188

Rule-ID|SV-89171r1_rule

STIG-ID|DB2X-00-005100

Vuln-ID|V-74497

DB2X-00-005100 - DB2 must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values - SSL_SVCENAME

800-53|SC-23

DB2X-00-005100 - DB2 must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values - SVCENAME

DB2X-00-005300 - In the event of a system failure, DB2 must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes - History

800-53|CP-9

CCI|CCI-001665

Rule-ID|SV-89173r1_rule

STIG-ID|DB2X-00-005300

Vuln-ID|V-74499

DB2X-00-005300 - In the event of a system failure, DB2 must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes - Recovery Plan

DB2X-00-005300 - In the event of a system failure, DB2 must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes - Roll forward

DB2X-00-005300 - In the event of a system failure, DB2 must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes - Tested

DB2X-00-005800 - Access to database files must be limited to relevant processes and to authorized, administrative users - Audit Log

CCI|CCI-001090

Rule-ID|SV-89181r1_rule

STIG-ID|DB2X-00-005800

Vuln-ID|V-74507

DB2X-00-005800 - Access to database files must be limited to relevant processes and to authorized, administrative users - Backup History

DB2X-00-005800 - Access to database files must be limited to relevant processes and to authorized, administrative users - Database

DB2X-00-005800 - Access to database files must be limited to relevant processes and to authorized, administrative users - Instance

DB2X-00-005800 - Access to database files must be limited to relevant processes and to authorized, administrative users - LOGARCHMETH

DB2X-00-005800 - Access to database files must be limited to relevant processes and to authorized, administrative users - Transaction Paths

DB2X-00-007300 - DB2 must utilize centralized management of the content captured in audit records generated by all components of DB2.

800-53|AU-3(2)

CCI|CCI-001844

Rule-ID|SV-89241r1_rule

STIG-ID|DB2X-00-007300

Vuln-ID|V-74567

DB2X-00-007500 - DB2 must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

800-53|AU-4

CCI|CCI-001849

Rule-ID|SV-89243r1_rule

STIG-ID|DB2X-00-007500

Vuln-ID|V-74569

DB2X-00-007600 - DB2 must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75% of maximum audit record storage capacity.

800-53|AU-5(1)

CCI|CCI-001855

Rule-ID|SV-89245r1_rule

STIG-ID|DB2X-00-007600

Vuln-ID|V-74571

DB2X-00-007700 - DB2 must provide an immediate real-time alert to appropriate support staff of all audit failure events requiring real-time alerts.

CCI|CCI-001858

Rule-ID|SV-89247r1_rule

STIG-ID|DB2X-00-007700

Vuln-ID|V-74573

DB2X-00-008100 - DB2 and the operating system must enforce access restrictions associated with changes to the configuration of DB2 or database(s) - Install

CCI|CCI-001813

Rule-ID|SV-89265r1_rule

STIG-ID|DB2X-00-008100

Vuln-ID|V-74591

DB2X-00-008100 - DB2 and the operating system must enforce access restrictions associated with changes to the configuration of DB2 or database(s) - Instance

DB2X-00-008200 - DB2 must produce audit records of its enforcement of access restrictions associated with changes to the configuration of DB2 or database(s) - OS Auditing

800-53|AU-12

CCI|CCI-001814

Rule-ID|SV-89267r1_rule

STIG-ID|DB2X-00-008200

Vuln-ID|V-74593

DB2X-00-008300 - DB2 must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance - SSL

CCI|CCI-001762

Rule-ID|SV-89269r1_rule

STIG-ID|DB2X-00-008300

Vuln-ID|V-74595

DB2X-00-008300 - DB2 must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance - SSL_SVCENAME

DB2X-00-008300 - DB2 must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance - SVCENAME

DB2X-00-009100 - DB2 must maintain the confidentiality and integrity of information during preparation for transmission.

CCI|CCI-002420

Rule-ID|SV-89279r2_rule

STIG-ID|DB2X-00-009100

Vuln-ID|V-74605

DB2X-00-009200 - DB2 must maintain the confidentiality and integrity of information during reception.

CCI|CCI-002422

Rule-ID|SV-89281r2_rule

STIG-ID|DB2X-00-009200

Vuln-ID|V-74607

DB2X-00-012600 - DB2 must off-load audit data to a separate log management facility; this must be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for stand-alone systems.

800-53|AU-4(1)

CCI|CCI-001851

Rule-ID|SV-89249r1_rule

STIG-ID|DB2X-00-012600

Vuln-ID|V-74575

DISA_STIG_IBM_DB2_v10.5_LUW_v1r4_OS_Linux.audit from DISA IBM DB2 V10.5 LUW v1r4 STIG

Detections

Analytics

Revision 1.3

Apr 22, 2021

Functional Update

Miscellaneous