6.2.1 Review Users, Groups, and Roles

Information

With row and column access control, individuals are permitted access to only the subset of data that is required to perform their job tasks. Periodic review of these individuals is crucial when trying to keep data secure. As business needs move forward, requirements behind accessing the data may change, leading to a revision in security policy. By inspecting the list of users, groups, and roles, you are identifying excessive privileges that could pose possible security threats within your infrastructure.

Rationale:

If a user (either by himself or part of a group or role) is no longer required access to the data that is protected by row and column access controls, allowing that individual to maintain access allows that individual to compromise the confidentiality, integrity, and/or availability of the data in the Db2 instance.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

To remove users from your database environment:

Linux:

userdel -r <user name>

Windows:

Run compmgmt.msc

Click 'Local Users and Groups'

Double click 'Users'

Right-click on

Select 'Delete'

To remove groups from your database environment:

Linux:

groupdel -r <group name>

Windows:

Run compmgmt.msc

Click 'Local Users and Groups'

Double click 'Groups'

Right-click on

Select 'Delete'

To remove roles or role members from your database environment:

Connect to Db2 database:

db2 => connect to <dbname>

To remove role members from roles:

db2 => revoke role <role name> from <userroup/role member>

To remove roles:

db2 => drop role <role name>

See Also

https://workbench.cisecurity.org/benchmarks/10752

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: IBM_DB2DB

Control ID: 17cf041d944319ff2711fcbfcef8cab70ba70a9d507f79dba2488e06f3ab4b9b