IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
S 2.132 Provisions for configuring database users /
user groups
Initiation responsibility: Head of IT Section, IT Security Management
Implementation responsibility: Administrators
Users and user groups need to be configured in order to ensure an appropriate
allocation of access rights (refer to S 2.129 Controlling access to database
information) as well as correct and controlled operation. For this purpose,
every database user generally receives an internal database ID with which the
database identifies the user. This ensures that only authorised persons can
access the database.
As described in S 2.30 Provisions governing the designation of users and user
groups, a form should be prepared for the purpose of gathering details
pertaining to each user and user group:
- Surname, first name
- Proposed user ID (if not assigned by conventions)
- Organisational unit
- Reachability (e.g. telephone, room)
- If applicable: project
- If applicable: intended applications which should be used and need to
access the database system
- If applicable: details on planned activities in the database system -
including their duration - and the rights required for this purpose
- If applicable: restrictions imposed on times, access rights (for certain
tables, views etc.) and restricted user environments
- If applicable: Approval by superiors
A limited number of authorisation profiles must be specified. New users are
assigned to one or more profiles, thus receiving precisely those rights which
are required for performing their individual activities. Database-specific
possibilities of configuring users and user groups need to be considered here.
It is advisable to specify naming conventions for user IDs and group IDs (e.g.
user ID = abbreviation of organisational unit || serial number).
User, role, and group profiles can be used here. If possible, user-specific
profiles should not be employed, as a high number of users would require a
great deal of administrative effort. A balance needs to be struck between
restrictive and liberal authorisation profiles when defining group profiles. If
group profiles are made too restrictive, a large number of groups will need to
be maintained, thus requiring a lot of administrative effort. If group profiles
are made too liberal, redundancies could arise between the different groups, or
granted rights could prove unnecessarily extensive, thus holding a potential
for impairing the confidentiality of data.
As a rule, every user should be assigned a separate database ID; several users
must not be allowed to operate under the same ID.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000