Secure DATAACCESS Authority

HighLevel 1Manual reviewdb2

Description

Grants the authority to access data. The DATAACCESS authority allows the grantee to leverage DML level commands i.e. SELECT, INSERT, UPDATE, DELETE, LOAD, and EXECUTE any package or routine. The DATAACCESS authority cannot be granted to PUBLIC.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

1. Run the following command: db2 => select distinct grantee, granteetype from syscat.dbauth where dataaccessauth = 'Y' 2. Review the list of users, groups, and roles in the above output to ensure only approved users, groups, and roles are assigned.

How it is fixed

Fix method: Guidance or infrastructure patch

Revoke DATAACCESS authority from any unauthorized users. db2 => REVOKE DATAACCESS ON DATABASE FROM USER <username>

Properties

Operating systems: Any
Tags: db2databasemanual
Reference: CIS IBM Db2 12.1 Benchmark v1.0.0 - 6.1.8 Secure DATAACCESS Authority