Download PDF - IBM Redbooks

8.1.4 Migration from SYSADM authority
To take advantage of the granularity for DB2 10 administrative authority and to simplify your
system database administration, you can separate the privileges of SYSADM authority and
migrate them to other administrative authorities, as illustrated in Figure 8-1.
SYSADM
Figure 8-1 Separating the privileges of SYSADM
For implementation of the new security model based on new DB2 system authorities, use the
following rules:
► Identify the administration model, and define the criteria for assigning special system
authorities for specific ROLEs or AUTHIDs.
► Perform a query to list all users who have SYSADM authority in your DB2 subsystem.
► Divide the responsibilities of the SYSADM authorities between this list of users, and grant
the necessary authority to them.
► Revoke SYSADM authority from current authorization IDs or ROLEs.
► After SYSADM authority is revoked, set the SECURITY_SEPARATE parameter to YES, and
change it dynamically by using the installation SYSADM user ID.
8.2 New audit policy for DB2 10
SECADM
Perform security related tasks
System DBADM
Manage Objects
DATAACCESS
A ccess da ta in all user ta bles
System Administrator
Requires SYSOPR, ARCHIVE, BSDS,
CREATESG, STOSPACE
ACCESSCTRL
Contr ol data access except for
security objects
SQLADM
EXPLAIN, monitor queues
Additional information: For more information about the new DB2 system authorities, see
the DB2 10 for z/OS Administration Guide, SC19-2968.
With the WikiLeaks scandal, the new BASEL III requirements, the HIPAA privacy
requirements, and many data breaches gaining press coverage, security audits of the DB2
environment have become a requirement for protection against unknown or unacceptable
behaviors of users. Successful monitoring of unwanted data access and subsequent analysis
can lead to improvements in the control of data access and the ultimate prevention of
Chapter 8. Security enhancements of DB2 10 for SAP solutions 117