CIS IBM Db2 Benchmark

This recommendation verifies that Db2 Is Installed with Latest Fix Pack on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that Db2 Is Installed with Latest Fix Pack:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Db2 Is Installed with Latest Fix Pack:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that Db2 Runs Under a Dedicated Service Account on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that Db2 Runs Under a Dedicated Service Account:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Db2 Runs Under a Dedicated Service Account:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This setting ensures that Db2 Instance Directories Have Restricted Permissions on the IBM Db2 database server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the IBM Db2 database server is essential for defense in depth.

Connect to the Db2 instance and verify that Db2 Instance Directories Have Restricted Permissions:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Db2 Instance Directories Have Restricted Permissions:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that Db2 Configuration Files Are Protected on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that Db2 Configuration Files Are Protected:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Db2 Configuration Files Are Protected:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that SYSADM_GROUP Is Set to a Dedicated Group on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that SYSADM_GROUP Is Set to a Dedicated Group:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure SYSADM_GROUP Is Set to a Dedicated Group:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that SYSCTRL_GROUP Is Configured on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that SYSCTRL_GROUP Is Configured:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure SYSCTRL_GROUP Is Configured:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that DIAGLEVEL Is Set to 3 or Higher on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that DIAGLEVEL Is Set to 3 or Higher:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure DIAGLEVEL Is Set to 3 or Higher:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that DISCOVER Is Set to DISABLE on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that DISCOVER Is Set to DISABLE:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure DISCOVER Is Set to DISABLE:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that AUTHENTICATION Is Set to SERVER_ENCRYPT or Better on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that AUTHENTICATION Is Set to SERVER_ENCRYPT or Better:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure AUTHENTICATION Is Set to SERVER_ENCRYPT or Better:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that Kerberos or LDAP Authentication Is Configured on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that Kerberos or LDAP Authentication Is Configured:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Kerberos or LDAP Authentication Is Configured:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that DATA_ENCRYPT Authentication Is Used for Sensitive Data on the IBM Db2 database server. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the IBM Db2 database server uses the correct component aligns with industry best practices and standards.

Connect to the Db2 instance and verify that DATA_ENCRYPT Authentication Is Used for Sensitive Data:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure DATA_ENCRYPT Authentication Is Used for Sensitive Data:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation ensures that Password Complexity Is Enforced via OS or LDAP on the IBM Db2 database server. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the IBM Db2 database server may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

Connect to the Db2 instance and verify that Password Complexity Is Enforced via OS or LDAP:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Password Complexity Is Enforced via OS or LDAP:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that Default Db2 Accounts Are Secured on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that Default Db2 Accounts Are Secured:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Default Db2 Accounts Are Secured:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that Connection Timeout Is Configured on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that Connection Timeout Is Configured:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Connection Timeout Is Configured:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that Failed Login Lockout Is Configured on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that Failed Login Lockout Is Configured:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Failed Login Lockout Is Configured:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that PUBLIC Privileges Are Revoked from System Tables on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that PUBLIC Privileges Are Revoked from System Tables:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure PUBLIC Privileges Are Revoked from System Tables:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation ensures that CONNECT Privilege Is Granted Only to Required Users on the IBM Db2 database server. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the IBM Db2 database server may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

Connect to the Db2 instance and verify that CONNECT Privilege Is Granted Only to Required Users:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure CONNECT Privilege Is Granted Only to Required Users:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that DBADM Authority Is Granted to Minimum Users on the IBM Db2 database server. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the IBM Db2 database server uses the correct component aligns with industry best practices and standards.

Connect to the Db2 instance and verify that DBADM Authority Is Granted to Minimum Users:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure DBADM Authority Is Granted to Minimum Users:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that SECADM Authority Is Assigned on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that SECADM Authority Is Assigned:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure SECADM Authority Is Assigned:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This setting ensures that Implicit Schema Creation Is Restricted on the IBM Db2 database server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the IBM Db2 database server is essential for defense in depth.

Connect to the Db2 instance and verify that Implicit Schema Creation Is Restricted:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Implicit Schema Creation Is Restricted:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that Table and View Permissions Follow Least Privilege on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that Table and View Permissions Follow Least Privilege:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Table and View Permissions Follow Least Privilege:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This setting ensures that Routine Execute Privileges Are Restricted on the IBM Db2 database server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the IBM Db2 database server is essential for defense in depth.

Connect to the Db2 instance and verify that Routine Execute Privileges Are Restricted:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Routine Execute Privileges Are Restricted:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that SSL/TLS Is Enabled for Client Connections on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that SSL/TLS Is Enabled for Client Connections:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure SSL/TLS Is Enabled for Client Connections:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that TLS 1.2 Is the Minimum Version on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that TLS 1.2 Is the Minimum Version:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure TLS 1.2 Is the Minimum Version:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation ensures that Db2 Listens Only on Required Interfaces on the IBM Db2 database server. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the IBM Db2 database server may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

Connect to the Db2 instance and verify that Db2 Listens Only on Required Interfaces:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Db2 Listens Only on Required Interfaces:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that TCP/IP Port Is Not Default for Production on the IBM Db2 database server. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the IBM Db2 database server increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Connect to the Db2 instance and verify that TCP/IP Port Is Not Default for Production:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure TCP/IP Port Is Not Default for Production:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This setting ensures that Federation Server Access Is Restricted on the IBM Db2 database server. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the IBM Db2 database server is essential for defense in depth.

Connect to the Db2 instance and verify that Federation Server Access Is Restricted:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Federation Server Access Is Restricted:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that Db2 Communication Manager Is Hardened on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that Db2 Communication Manager Is Hardened:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Db2 Communication Manager Is Hardened:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that Db2 Audit Facility Is Enabled on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that Db2 Audit Facility Is Enabled:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Db2 Audit Facility Is Enabled:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that CHECKING Category Is Audited on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that CHECKING Category Is Audited:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure CHECKING Category Is Audited:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that VALIDATE Category Is Audited on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that VALIDATE Category Is Audited:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure VALIDATE Category Is Audited:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that SYSADMIN Category Is Audited on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that SYSADMIN Category Is Audited:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure SYSADMIN Category Is Audited:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that OBJMAINT Category Is Audited on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that OBJMAINT Category Is Audited:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure OBJMAINT Category Is Audited:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that Audit Logs Are Stored on Separate Volume on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that Audit Logs Are Stored on Separate Volume:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Audit Logs Are Stored on Separate Volume:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that Audit Log Archiving Is Configured on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that Audit Log Archiving Is Configured:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Audit Log Archiving Is Configured:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that Audit Logs Are Forwarded to SIEM on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that Audit Logs Are Forwarded to SIEM:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Audit Logs Are Forwarded to SIEM:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that Native Encryption Is Enabled for Databases on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that Native Encryption Is Enabled for Databases:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Native Encryption Is Enabled for Databases:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that Encryption Key Management Is Configured on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that Encryption Key Management Is Configured:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Encryption Key Management Is Configured:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that Backup Encryption Is Enabled on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that Backup Encryption Is Enabled:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Backup Encryption Is Enabled:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that Automatic Database Backups Are Configured on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that Automatic Database Backups Are Configured:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Automatic Database Backups Are Configured:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that LOGARCHMETH1 Is Configured for Log Archiving on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to properly configure this setting may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that LOGARCHMETH1 Is Configured for Log Archiving:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure LOGARCHMETH1 Is Configured for Log Archiving:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.

This recommendation verifies that Recovery History File Is Protected on the IBM Db2 database server. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the IBM Db2 database server vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Connect to the Db2 instance and verify that Recovery History File Is Protected:

db2 get dbm cfg | grep -i ...

Alternatively, review the database configuration using db2 get db cfg.

Update the Db2 configuration to ensure Recovery History File Is Protected:

db2 update dbm cfg using PARAMETER VALUE

Restart the instance if required.