DB2 Database Security, Risk And Control: An IT Auditor’s View
IBM DB2 database security, risks and controls are discussed below from an IT auditor’s view. This area is especially relevant due to the persistent attacks on DB2 and other commercial databases resulting in the disclosure of huge amounts of confidential data.
IT audits are planned with an understanding of the risks around the technology and the controls that are expected to be in place. The controls are then tested to determine their effectiveness. This risk and control approach is fundamental to IT auditing and critical to effective security.
Below we will discuss the most critical DB2 risks and controls taken from different sources of DB2 security best practices. Overall, there is substantial agreement on database security and the underlying risks and controls that are used in an audit of DB2.
Two valuable sources of guidance on DB2 risks and controls are an article in the IBM Technical Library titled ’12 DB2 Security Best Practices’ and a white paper from Imperva, a security vendor titled ‘Top Ten Database Security Threats’. Both of these sources are recommended to IT auditors as well as database administrators for guidance on DB2 security.
The discussion below is based on these two sources as correlated with our professional IT audit experience in this area. We will highlight the major themes in DB2 security, without going through the detail of every risk and control.
DB2 Risks. Threats and vulnerabilities are the main components of risk. DB2 threats relate to unauthorized user access, faulty authentication and misuse of privileges. Network threats come from the potential for denial of service attacks directed at a database. One of the most serious threats is SQL injection which correlates to the annual SANS Top Cyber Security Risks.
There are database vulnerabilities from the underlying operating system and network configuration. Although these vulnerabilities are really in the supporting infrastructure surrounding the database, the direct impact of an attack or compromise on the database should be understood clearly. If these risks are addressed effectively an organization can get reasonable assurance that security and compliance requirements will be met even in the most regulated industries.
DB2 controls. The IBM and Imperva sources refer to critical DB2 controls. Remember that risks are mitigated or reduced with specific controls.
DB2 controls are implemented to reduce the risks described above. Controls are required to secure user access, authentication and privileges. SQL injection is identified as a high risk that requires strong controls.
An important control is to apply the most up-to-date DB2 FixPaks which consist of bug fixes and performance enhancements. A final control is a random security audit where database logs are analyzed for access patterns such as user validation, authorization checking and system administration.
Common Themes of DB2 Security. As discussed above, there is some degree of consensus in the security, risk and control of DB2 databases. An organization that understands the DB2 risks and implements the appropriate controls as discussed above will go a long way toward a secure DB2 environment.
References:
12 DB2 Security Best Practices by Ted Wasserman. IBM Technical Library
‘developerWorks’.
Top Ten Database Security Threats – How to Mitigate the Most Significant
Database Vulnerabilities. Imperva White Paper.
SANS Top Cyber Security Risks.