IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Organisation Remarks
____________________________________________________________________ .........................................
Normally, there is no association between a database ID and the user ID of the
underlying operating system. However, some database software packages
offer the possibility of copying the operating-system ID to the database
system. This eliminates the need for users to answer the password prompt for
database access if they have already logged in with their operating-system ID.
Oracle allows the use of OPS$ IDs, for example. This type of ID is composed
of the prefix "OPS$" and the operating-system ID of the user. If a user logs
into the database system with his operating-system ID, the database
management system does not request the entry of a password. If a user logs in
with a different ID though, a password is required.
However, this possibility poses a hazard that access to the database might no
longer be deniable if a security violation occurs on the operating-system level
(e.g. if the related password is cracked). Consequently, the security of the
database relies heavily on the security of the underlying operating system.
This does not generally imply the operating system of the database server -
which is usually reliable - but that of the client, which is protected to a much
lesser degree in some cases. Consequently, it is not advisable to make use of
this possibility; instead, the use of an add-on product for central user
management throughout the IT operation (e.g. ISM Access Master by Bull)
should be considered in order to facilitate handling for users (keyword: Single-
Sign-On). Here too though, harmonisation is required between the selected
add-on product and the applicable security requirements.
Additional controls:
- Which organisational rules exist for the configuration of database users and
user groups?
- Have naming conventions been specified for user IDs and group IDs?
- Have authorisation profiles been created?
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000