Detections
Analytics

6.1.6 Secure DBADM Authority

Information

The DBADM (database administration) role grants the authority to a user to perform administrative tasks on a specific database. It is recommended that the DBADM role be granted to authorized users only.

Rationale:

If an account that possesses this authority is compromised or used in a malicious manner, the confidentiality, integrity, and availability of data in the database will be at increased risk.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Revoke this permission from any unauthorized users.

Connect to the Db2 database.

db2 => connect to <dbname>

Run the following command:

db2 => REVOKE DBADM ON DATABASE FROM USER <username>

See Also

https://workbench.cisecurity.org/benchmarks/23492

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: IBM_DB2DB

Control ID: 3f4f3ccc73047ec18ce757f5dc2b638929776ec90b332a73557be0c9ed9fa0db