Ensure that access to SYSIBM.SYSCOLAUTH is restricted

MediaNivel 1Revisión manualdb2-zos

Descripción

The SYSIBM.SYSCOLAUTH table records the UPDATE or REFERENCES privileges that are held by users on individual columns of a table or view. PUBLIC should be restricted from accessing this table. This table contains the column privileges granted to a user or role and can be used as an attack vector. Exposing who has access to a particular column of a table or view can enable attackers to identify those user IDs to gain access to the columns.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

For Db2 internal security users: Issue the following SQL statement to check if PUBLIC has access: SELECT GRANTEE FROM SYSIBM.SYSTABAUTH WHERE TCREATOR = 'SYSIBM' AND TTNAME = 'SYSCOLAUTH' AND GRANTEE = 'PUBLIC'; Output that contains zero rows is considered a successful finding. Otherwise, PUBLIC has SELECT privilege and the remediation steps should be followed. For external security users: Issue the RACF RLIST command to list the profile that controls access to the SYSIBM.SYSCOLAUTH table in the MDSNTB class. Examine the universal access (UACC) and user ... (full steps: CIS section 2.2.3)

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

For Db2 internal security users: Issue the following SQL statement to revoke access from PUBLIC: REVOKE ALL ON SYSIBM.SYSCOLAUTH FROM PUBLIC; For external security users: Issue the RACF RALTER command to update the profile and change the UACC setting to NONE. Issue the RACF PERMIT command to remove the ID(*) and specify users or groups.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: db2-zospermissions
Referencia: CIS IBM Db2 13 for z/OS Benchmark v1.0.0 - 2.2.3 Ensure that access to SYSIBM.SYSCOLAUTH is restricted