STIGQter STIGQter: STIG Summary: Oracle Database 11.2g Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Apr 2021:

DBMS production application and data directories must be protected from developers on shared production/development DBMS host systems.

DISA Rule

SV-219724r401224_rule

Vulnerability Number

V-219724

Group Title

SRG-APP-000516-DB-000363

Rule Version

O112-BP-024100

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Create separate DBMS host OS groups for developer and production DBAs.

Do not assign production DBA OS group membership to accounts used for development.

Remove development accounts from production DBA OS group membership.

Recommend establishing a dedicated DBMS host for production DBMS installations (See Checks O112-BP-025000 and O112-BP-025300). A dedicated host system in this case refers to an instance of the operating system at a minimum. The operating system may reside on a virtual host machine where supported by the DBMS vendor.

Check Contents

If the DBMS or DBMS host is not shared by production and development activities, this check is Not a Finding.

Review OS DBA group membership.

If any developer accounts as identified in the System Security Plan have been assigned DBA privileges, this is a Finding.

NOTE: Though shared production/non-production DBMS installations was allowed under previous database STIG guidance, doing so may place it in violation of OS, Application, Network or Enclave STIG guidance. Ensure that any shared production/non-production DBMS installations meets STIG guidance requirements at all levels or mitigate any conflicts in STIG guidance with your DAA.

Vulnerability Number

V-219724

Documentable

False

Rule Version

O112-BP-024100

Severity Override Guidance

If the DBMS or DBMS host is not shared by production and development activities, this check is Not a Finding.

Review OS DBA group membership.

If any developer accounts as identified in the System Security Plan have been assigned DBA privileges, this is a Finding.

NOTE: Though shared production/non-production DBMS installations was allowed under previous database STIG guidance, doing so may place it in violation of OS, Application, Network or Enclave STIG guidance. Ensure that any shared production/non-production DBMS installations meets STIG guidance requirements at all levels or mitigate any conflicts in STIG guidance with your DAA.

Check Content Reference

M

Target Key

4057

Comments