Detections
Analytics

DB2X-00-000700 - DB2 must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - SYSADM_GROUP

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent or interfere with the auditing of critical events.

Suppression of auditing could permit an adversary to evade detection.

Misconfigured audits can degrade the system's performance by overwhelming the audit log. Misconfigured audits may also make it more difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Update the value SYSADM_GROUP to a group which has only members approved by the ISSM using the following command:

 $db2 update dbm cfg using SYSADM_GROUP <SYSADMIN GROUP>

Remove users not approved by ISSM from SYSADM_GROUP group using operating system tools/commands.

Revoke SECADM authority from non-ISSM users using the SQL statement:
DB2> REVOKE SECADM ON DATABASE FROM USER <user name>

Remove non-ISSM members using the following the following SQL statement:
DB2> REVOKE SECADM ON DATABASE FROM GROUP <group name>

Revoke SECADM from the group or role using the following SQL statement:
DB2> REVOKE SECADM ON DATABASE FROM ROLE <role name>

Revoke execute from unapproved users if they have execute on SYSPROC.AUDIT_ARCHIVE, SYSPROC.AUDIT_LIST_LOGS, SYSPROC.AUDIT_DELIM_EXTRACT using appropriate variation of Revoke (routine privileges) statement.

Note: The audit facility provides the ability to audit at both the instance and the individual database level, independently recording all instance and database level activities with separate logs for each instance level audit.

The system administrator (who holds SYSADM authority) can use the db2audit tool to configure audit at the instance level as well as to control when such audit information is collected. The system administrator can use the db2audit tool to archive both instance and database audit logs as well as to extract audit data from archived logs of either type.

SYSADM authority is assigned to the group specified by the SYSADM_GROUP configuration parameter. Membership in that group is controlled outside the database manager through the security facility used on your platform.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_IBM_DB2_V10-5_V1R4_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-9, CAT|II, CCI|CCI-000171, Rule-ID|SV-89113r1_rule, STIG-ID|DB2X-00-000700, Vuln-ID|V-74439

Plugin: IBM_DB2DB

Control ID: ad77cda32cd9fefb0efe16d313bf8e9ce3f245561c05881319374b76a47d42dc