Developers should not be assigned excessive privileges on production databases.

Part of Developer DBMS privileges on production databases

SV-24395r1_rule Developers should not be assigned excessive privileges on production databases.

Vulnerability discussion

Developers play a unique role and represent a specific type of threat to the security of the DBMS. Where restricted resources prevent the required separation of production and development DBMS installations, developers granted elevated privileges to create and manage new database objects must also be prevented from actions that can threaten the production operation.

Check content

If this database is not a production database, this check is Not a Finding. Review the privileges assigned to developer accounts. Identify login name of developer DBMS accounts from the System Security Plan and/or DBA. For each developer account, display the roles assigned to the account. From SQL*Plus: select granted_role from dba_role_privs where grantee=[developer account name]; If privileges assigned to developer accounts are not restricted to development objects and configurations, or authorizations to allow developer account access to production objects and configurations does not exist in the System Security Plan, this is a Finding.

Fix text

Revoke permissions and privileges that allow changes to the production system or production objects from developer accounts or authorize permissions and privileges for developer accounts in the System Security Plan.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.