V-213686

Discussion

Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit data. Applications providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys in order make access decisions regarding the modification of audit tools. Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.

Check Content

Run the following command to find the value of the SYSADM_GROUP parameter:

     $db2 get dbm cfg 

Only authorized OS users should be part of this group. If non-authorized users are part of SYSADM_GROUP group, this is a finding.

On Windows systems, if the SYSADM_GROUP database manager configuration parameter is not specified, this is a finding.

The security administrator (who holds SECADM authority within a database) can define audit policies and control the audit requirements for an individual database. The security administrator can use the following audit routines to operate upon the database audit logs:

- The SYSPROC.AUDIT_ARCHIVE stored procedure archives audit logs.
- The SYSPROC.AUDIT_LIST_LOGS table function allows you to locate logs of interest.
- The SYSPROC.AUDIT_DELIM_EXTRACT stored procedure extracts data into delimited files for analysis.

The security administrator can also grant EXECUTE privilege on these routines to another user.

Run the following query to find out which users have SECADM authority in the database: 
DB2> SELECT CHAR(GRANTOR,35) AS GRANTOR, CHAR(GRANTEE,35) AS GRANTEE, GRANTEETYPE  
           FROM SYSCAT.DBAUTH 
           WHERE SECURITYADMAUTH='Y'

If GRANTEETYPE is 'U' and the authorization ID is not an authorized user, this is a finding.

If the GRANTEETYPE is 'G', then all members of the external group identified by GRANTEE must be authorized users; otherwise, this is a finding.

If the GRANTEETYPE is 'R', then all members of the database role identified by GRANTEE must be authorized users; otherwise, this is a finding.

The members of a role can be found using this statement: 
DB2> SELECT CHAR(GRANTOR,35) AS GRANTOR, CHAR(GRANTEE,35) AS GRANTEE, GRANTEETYPE 
           FROM SYSCAT.ROLEAUTH 
           WHERE ROLENAME= <search role name>

Run the following query to find out which users have execute privilege on SYSPROC.AUDIT_ARCHIVE, SYSPROC.AUDIT_LIST_LOGS, SYSPROC.AUDIT_DELIM_EXTRACT:
DB2> SELECT * 
           FROM SYSCAT.ROUTINEAUTH 
           WHERE SPECIFICNAME LIKE 'AUDIT%' AND SCHEMA='SYSPROC'

If non-authorized users have EXECUTE privilege on any of the above three routines, this is a finding.