On successful completion of this course you will be able to:

• describe Db2 security
• understand terminology used with Db2 security
• use and structure Db2 security tables
• use primary, secondary, and CURRENT SQLID authorisation IDs used by Db2
• use SQL to control security using the GRANT and REVOKE statements
• describe the meaning of explicit, implicit and system privileges and administrative authorities
• explain ownership considerations with regard to Db2 objects
• control Db2 address space and data set authorisation using RACF
• use RACF to control access to Db2 objects
• describe the RACF classes for Db2 objects
• create RACF profiles for Db2 objects
• understand the additional considerations when using Db2 in a distributed environment.

• Introduction to Db2 Security
  • Security overview
  • Sign-on security
  • Connection security
  • Db2 internal security
  • Other options
  • Security strategy (Transaction Manager or Db2)
  • Security strategy (centralised or decentralised)
  • Using remote applications
• Internal Db2 Security
  • Db2 security
  • Db2 security mechanism
  • Db2 security tables
  • Security terms
  • Authorisation ID
  • Privilege
  • Resource
  • Primary and Secondary Authorisation IDs
  • Maintaining security
  • Data Control Language
  • Grouped privileges
  • Explicit & implicit privileges
  • Ownership considerations
  • Static and Dynamic SQL
  • Static SQL considerations
  • Dynamic SQL considerations
  • Db2 security disadvantages
• Data Control Language & Privileges
  • SQL GRANT and REVOKE statements
  • Cascading REVOKE
  • Package, plan & collection privileges
  • Database, table, & view privileges
  • Other object privileges
  • System privileges
  • DCL examples: application development, Bind, program execution
  • Insufficient authority
• Db2 Security Reporting and Auditing
  • Db2 catalog security tables
  • Common table columns
  • Security tables 1 - 4
  • Auditing tables
  • Audit trace
• RACF Security Overview
  • What is RACF?
  • Identifying and verifying users
  • Checking authorisations
  • Recording and reporting
  • Terminology - users and groups
  • Terminology - resources and classes
  • Terminology - profiles
  • User profile
  • Resource Profile
  • Discrete and generic profiles
  • Creating Generic Profiles
  • Maintaining RACF Security
• Defining the Db2 Subsystem to RACF
  • Address space authorisation
  • Protected access profiles
  • RACF router table
  • Db2 address spaces
  • Permitting RACF access
  • Protecting Db2 datasets - create profiles
  • Protecting Db2 datasets - permitting access
• Defining Db2 Objects to RACF
  • Native Db2 security
  • Db2 with RACF
  • RACF / Db2 external security module
  • Installation
  • Mapping Db2 authorisation checks
  • Scope of RACF classes
  • Multi-subsystem scope classes
  • Single subsystem scope classes
  • Customisation
  • Db2 objects and RACF classes
  • Profiles
  • Privileges - buffer pools, storage groups & tablespaces
  • Privileges - Db2 system
  • Privileges - database and schema
  • Privileges - tables, views, indexes and user-defined functions
  • Privileges - collection, plan and package
  • Privileges - distinct types, sequences and stored procedures
  • Privileges - administrative authorities
  • Insufficient authority
• Row & Column Level Access Control
  • The traditional approach
  • Multi-level security overview
  • Security labels
  • Row level granularity
  • Multi-level security and SELECT
  • Multi-level security and INSERT
  • Multi-level security and UPDATE
  • Multi-level security and DELETE
  • Multi-level security and utilities
  • Row permissions & column masks
  • Defining row permissions
  • Using row permissions
  • Defining column masks
  • Using column masks
  • SYSIBM.SYSCONTROLS
• Distributed Data Considerations
  • Distributed Data overview
  • DDF components
  • Communications tables
  • Security actions (client)
  • Security actions (server with SNA client)
  • Security actions (server with TCP/IP client)

Live instructor-led training, with plenty of opportunities for hands-on exercises and discussion.
The course is available for exclusive, one-company presentations and for regularly scheduled live presentations over the Internet, via the Virtual Classroom Environment service.

Delivered as a live, interactive online training

A working knowledge of RACF and an understanding of Db2 for z/OS at a conceptual & terminological level.

All Db2 or RACF security administrators wishing to gain further insight into controlling Db2 security using RACF.