DBMS production application and data directories must be protected from developers on shared production/development DBMS host systems.
An XCCDF Rule
Description
<VulnDiscussion>Developer roles should not be assigned DBMS administrative privileges to production DBMS application and data directories. The separation of production DBA and developer roles helps protect the production system from unauthorized, malicious or unintentional interruption due to development activities.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-219724r879887_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
Create separate DBMS host OS groups for developer and production DBAs.
Do not assign production DBA OS group membership to accounts used for development.
Remove development accounts from production DBA OS group membership.