TMA-DB2-ZOS-3.1.5

Enable auditing of system administrator access

높음레벨 1수동 검토db2-zos

설명

System administrator authorities perform system administrator tasks and include administrative authorities such as SYSADM, SYSCTRL, and SYSOPR. The SYSADM authority has access to all data. Auditing tasks that are performed by system administrators can help detect unauthorized or malicious activities intended to do harm to Db2 data or the processing environment.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

For Db2 internal security users: Issue the following SQL statement to verify that the audit policy is enabled to audit SYSADM, SYSCTRL, SYSOPR or all authorities in SYSADMIN category: SELECT AUDITPOLICYNAME FROM SYSIBM.SYSAUDITPOLICIES WHERE SYSADMIN IN ('L','O','S','*'); For external security users: Ensure that SMF 80 trace is ON and the Db2 administrator profiles in RACF have AUDIT(ALL) specified.

조치 방법

조치 방식: 가이드 또는 인프라 패치

For Db2 internal security users: Enable AUDITPOLICIES with the SYSADMIN category to audit SYSADM, SYSCTRL, and SYSOPR authorities. For external security users: Specify AUDIT(ALL) for the Db2 administrator profiles in RACF and start SMF 80 trace.

속성

운영 체제: 모두
태그: db2-zosaudit
참고 자료: CIS IBM Db2 13 for z/OS Benchmark v1.0.0 - 3.1.5 Enable auditing of system administrator access