5.9 Ensure DML/DDL Grants are Limited to Specific Databases and Users

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version


DML/DDL includes the set of privileges used to modify or create data structures. This includes INSERT, SELECT, UPDATE, DELETE, DROP, CREATE, and ALTER privileges.


INSERT, SELECT, UPDATE, DELETE, DROP, CREATE, and ALTER are powerful privileges in any database. Such privileges should be limited only to those users requiring such rights. By limiting the users with these rights and ensuring that they are limited to specific databases, the attack surface of the database is reduced.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.


Perform the following steps to remediate this setting:

Enumerate the unauthorized users, hosts, and databases returned in the result set of the audit procedure

For each user, issue the following SQL statement (replace <user> with the unauthorized user, <host> with host name, and <database> with the database name):

REVOKE SELECT ON <host>.<database> FROM <user>;
REVOKE INSERT ON <host>.<database> FROM <user>;
REVOKE UPDATE ON <host>.<database> FROM <user>;
REVOKE DELETE ON <host>.<database> FROM <user>;
REVOKE CREATE ON <host>.<database> FROM <user>;
REVOKE DROP ON <host>.<database> FROM <user>;
REVOKE ALTER ON <host>.<database> FROM <user>;

See Also