DBMS production application and data directories must be protected from developers on shared production/development DBMS host systems.
An XCCDF Rule
Description
Developer roles should not be assigned DBMS administrative privileges to production DBMS application and data directories. The separation of production DBA and developer roles helps protect the production system from unauthorized, malicious or unintentional interruption due to development activities.
- ID
- SV-219724r879887_rule
- Version
- O112-BP-024100
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Create separate DBMS host OS groups for developer and production DBAs.
Do not assign production DBA OS group membership to accounts used for development.
Remove development accounts from production DBA OS group membership.
Recommend establishing a dedicated DBMS host for production DBMS installations (See Checks O112-BP-025000 and O112-BP-025300). A dedicated host system in this case refers to an instance of the operating system at a minimum. The operating system may reside on a virtual host machine where supported by the DBMS vendor.