Ensure that database roles and grants inside the engine give each login only the privileges its function requires, so that one compromised login cannot read or modify every schema.
Enforce Least Privilege Within the Database
CCC.RDMS.CN07 · Access
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.RDMS.CP01 | SQL Support | The service always accepts and executes queries written in the SQL language for data definition, manipulation, and retrieval. |
| CCC.RDMS.CP07 | DB Self Managed Credentials | The service always supports database users authenticated by a username and password that the user creates and manages. |
| CCC.RDMS.CP17 | Cloud Identity Authentication | The service may be configured to authenticate database users with short-lived tokens issued to the cloud provider's identity principals, so that no long-lived database password needs to be stored or rotated. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.RDMS.TH07 | Excessive Privileges are Granted Within the Database | Database roles and grants inside the engine may be configured more broadly than required, such as application users holding administrative roles or schemas readable by every login. Any authenticated user can then read or modify data beyond their function, impacting the confidentiality and integrity of all data in the instance. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.RDMS.CN07.AR01 | When a database login is used by an application, that login MUST NOT hold an administrative or superuser role. | tlp-amber, tlp-red |
| CCC.RDMS.CN07.AR02 | When privileges are granted on a schema or table, the grant MUST NOT be made to the engine's public or every-login role. | tlp-amber, tlp-red |