Detections
Analytics

4.3.33 Restrict Access to SYSIBM.SYSSECURITYPOLICYEXEMPTIONS

Information

The SYSIBM.SYSSECURITYPOLICYEXEMPTIONS table contains the exemption to a security policy that was granted to a database account. It is recommended that the PUBLIC role be restricted from accessing this table.

Rationale:

PUBLIC should not be able to view all the exemptions to the database security policies.

Solution

Perform the following to revoke access from PUBLIC.

Connect to the Db2 database.

db2 => connect to <dbname>

Run the following command:

db2 => REVOKE SELECT ON SYSIBM.SYSSECURITYPOLICYEXEMPTIONS

 FROM PUBLIC

See Also

https://workbench.cisecurity.org/benchmarks/23492

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: IBM_DB2DB

Control ID: d57240e7d31cf23b1abadeae9e6c2f4970a4b29c8e96f0dc0a3aa14c22bde17c