IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
Such procedures must also be documented.
All activities in this phase are to be performed by the general database
administrator in consultation with the application-specific administrators (in
order to specify the size of the database, for example).
3. Configuring the database
The third phase consists of implementing the user and group concepts and - if
required - the role concept. For this purpose, the general database
administrator configures the individual authorisation profiles, and creates all
the groups and administrative user IDs (for the application-specific
administrators). In this process, the instructions specified in S 2.132
Provisions forCconfiguring Database Isers / User Groups should be observed.
Naturally, access rights pertaining to individual database objects can only be
defined if these objects are already in existence (refer to step 4).
If the database software supports a distribution of data among several files or
hard disks, it is necessary to specify additional parameters assigning the
creation of these files as well as the corresponding memory sectors.
All the performed settings must be documented in detail (refer to S 2.25
Documentation on the System Configuration).
All activities in this phase are to be performed by the general database
administrator.
4. Creating and configuring database objects
In this last phase, the database objects of the individual applications are
created in accordance with the database security concept (refer to S 2.126
Creation of a Database Security Concept). If possible, this procedure should
be automated and logged using scripts. After the database objects have been
created, the related access rights for roles, groups and users are to be assigned.
Specific users can now also be configured on the basis of the existing
authorisation profiles.
All activities in this phase are to be performed by the application-specific
administrators.
Additional controls:
- Have users been informed about an impending installation?
- Are all the parameters and related values required during installation
known before the database is created?
- Are all post installation tasks required after the creation of the database
known?
- Have the installation, creation and configuration of the database and its
objects been documented?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000