1. Course materials may not be reproduced in whole or in part without the prior written permission of IBM. 5.1 © Copyright IBM Corporation 2008 DB2 9 Fundamentals (Exam 730) Classroom Resources Part 2: Security

2. © Copyright IBM Corporation 2008 Unit objectives After completing this unit, you should be able to: Identify the structure of the entire DB2 environment, which includes client, servers, gateways, and hosts. Use the db2 catalog command on the gateway and client. Use the basics of the SYSADM, SYSCTRL, SYSMAINT, and SYSMON authorities, which are set in the DBM CFG file. List the basics of the DBADM, LOAD, and SECADM authorities, which are set using the GRANT command and revoked using the REVOKE command. Identify what command each authority is allowed to run. Identify the different types of privileges and what they allow a user to do. Identify how a privilege is obtained/revoked explicitly, implicitly, or (for packages only) indirectly. Identify the basics of Label-Based Access Control, and how to define different types of policies based on this new security concept.

3. © Copyright IBM Corporation 2008 Certification Exam (730) objectives Knowledge of restricting data access Ability to identify and connect to DB2 servers and databases Knowledge of DB2 products (client, server, etc.) Knowledge of different privileges and authorities Knowledge of encryption options (data and network) Given a DDL SQL statement, knowledge to identify results (grant/revoke/connect statements)

4. © Copyright IBM Corporation 2008 Basic client-server-host configuration DB2 server or DB2 Connect Server (Gateway) WindowsAIXLinux DB2 on the host DB2 clients

5. © Copyright IBM Corporation 2008 DB2 authentication Implicit security checking: ATTACH TO DB2 Explicit security checking: CONNECT TO sample USER test1 USING Database Connection Information Database server = DB2/NT 9.1.0 SQL authorization ID = TEST1 Local database alias = SAMPLE

6. © Copyright IBM Corporation 2008 Authentication within the DBM configuration GET DBM CFG Server Connection Authentication (SRVCON_AUTH) = KERBEROS … Database manager authentication (AUTHENTICATION) = SERVER_ENCRYPT

7. © Copyright IBM Corporation 2008 DB2 authentication types SERVERSERVER_ENCRYPT CLIENT *KERBEROS*KRB_SERVER_ENCRYPT DATA_ENCRYPTDATA_ENCRYPT_CMP GSSPLUGINGSS_SERVER_ENCRYPT

8. © Copyright IBM Corporation 2008 DB2 Authorities

9. © Copyright IBM Corporation 2008 DB2 Privileges SYSCTRL SYSMAINT ALL ALTER DELETE INDEX INSERT REFERENCES SELECT UPDATE CONTROL (Tables) SYSADM.................... Authorities Privileges ALL DELETE INSERT SELECT UPDATE CONTROL (Views) BIND EXECUTE CONTROL (Packages) Schema Owner CREATEIN ALTERIN DROPIN CONTROL (Indexes) Table space Owner USE BINDADD CONNECT CREATETAB CREATE_EXTERNAL_ROUTINE CREATE_NOT_FENCED_ROUTINE IMPLICIT_SCHEMA LOAD QUIESCE_CONNECT (Database) EXECUTE (Routines) LOAD SYSMON SECADM DBADM

10. © Copyright IBM Corporation 2008 Explicit authorization GRANT/ REVOKE * Database privileges CONTROL ON DATABASE userid groupid PUBLIC * must be SYSADM, DBADM, or have CONTROL on object USE Table/view privileges OF TABLESPACE tablespacename ON TABLE table/view_name ON INDEX index_name TO/ FROM USER/ GROUP Schema privileges ON SCHEMA schema_name Package privileges ON PACKAGE package_name

11. © Copyright IBM Corporation 2008 LBAC (Label Based Access Control) query No LBACLBACIDSALARY 25560000 10050000 5070000 5045000 6030000 25056000 10282000 10054000 7533000 25346000 9083000 20078000 10545000 SELECT * FROM EMP WHERE SALARY >= 50000 User Level = 100 Users with user level 100 can view the rows with ID = 50000 (indicated in green) With no LBAC user level imposed, users can view rows that meet the salary >= 50000 qualifier (shown in red)

12. © Copyright IBM Corporation 2008 Example implementation of LBAC Steps overview: 1.Define the security policies and labels a.Define the security label component b.Define the security policy c.Define the security labels 2.Create the protected SALES table by including a column that holds the security label and attaching the security policy to the table. 3.Grant the appropriate security labels to users. Requires SECADM authority to execute commands for creating security policies and labels.

13. © Copyright IBM Corporation 2008 Unit summary Having completed this unit, you should be able to: Identify the structure of the entire DB2 environment, which includes client, servers, gateways, and hosts. Use the db2 catalog command on the gateway and client. Use the basics of the SYSADM, SYSCTRL, SYSMAINT, and SYSMON authorities, which are set in the DBM CFG file. List the basics of the DBADM, LOAD, and SECADM authorities, which are set using the GRANT command and revoked using the REVOKE command. Identify what command each authority is allowed to run. Identify the different types of privileges and what they allow a user to do. Identify how a privilege is obtained/revoked explicitly, implicitly, or (for packages only) indirectly. Identify the basics of Label-Based Access Control, and how to define different types of policies based on this new security concept.