Detections
Analytics

DB2X-00-010400 - DB2 must generate audit records when security objects are modified

Information

Changes in the database objects (tables, views, procedures, functions) that record and control permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized changes to the security subsystem could go undetected. The database could be severely compromised or rendered inoperative.

Solution

Run the following command to define an audit policy with the needed subset using the CREATE AUDIT POLICY SQL statement:
DB2> CREATE AUDIT POLICY <execdb> CATEGORIES OBJMAINT STATUS SUCCESS, SECMAINT STATUS SUCCESS ERROR TYPE AUDIT
 or
 CREATE AUDIT POLICY <execdb> CATEGORIES OBJMAINT STATUS SUCCESS, SECMAINT STATUS BOTH ERROR TYPE AUDIT

To modify an existing audit policy, replace 'CREATE' with 'ALTER' in the preceding statement. Only the categories explicitly named in the statement will be affected. In this case, the changes take effect immediately.

If CREATE was used above, run the following command to apply the correct policy to local security tables or database level:
DB2> AUDIT TABLE <table name> USING POLICY EXECDB

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_IBM_DB2_V10-5_LUW_V2R1_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12c., CAT|II, CCI|CCI-000172, Rule-ID|SV-213743r879867_rule, STIG-ID|DB2X-00-010400, STIG-Legacy|SV-89303, STIG-Legacy|V-74629, Vuln-ID|V-213743

Plugin: IBM_DB2DB

Control ID: d0b65252da133b880510e1040678a69fff035161411ed097a853e6359e3e1bb1