STIGQter: STIG Summary: Oracle MySQL 8.0 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Jan 2021:

The MySQL Database Server 8.0 must protect the confidentiality and integrity of all information at rest.

DISA Rule

SV-235155r638812_rule

Vulnerability Number

V-235155

Group Title

SRG-APP-000231-DB-000154

Rule Version

MYS8-00-007200

Severity

CAT I

CCI(s)

• CCI-001199 - The information system protects the confidentiality and/or integrity of organization-defined information at rest.

Weight

10

Fix Recommendation

Apply appropriate MySQL Database 8.0 controls to protect the confidentiality and integrity of data at rest in the database.

sudo vi /etc/my.cnf
[mysqld]
audit-log=FORCE_PLUS_PERMANENT
audit-log-format=JSON
audit-log-encryption=AES

Turn on binlog encryption
set persist binlog_encryption=ON;

Turn on undo and redo log encryption
set persist innodb_redo_log_encrypt=ON;
set persist innodb_undo_log_encrypt=ON;

Enable encryption for a new file-per-table tablespace, specify the ENCRYPTION option in a CREATE TABLE statement.
The following example assumes that innodb_file_per_table is enabled.
mysql> CREATE TABLE t1 (c1 INT) ENCRYPTION='Y';

To enable encryption for an existing file-per-table tablespace, specify the ENCRYPTION option in an ALTER TABLE statement.
mysql> ALTER TABLE t1 ENCRYPTION='Y';

To disable encryption for file-per-table tablespace, set ENCRYPTION='N' using ALTER TABLE.
mysql> ALTER TABLE t1 ENCRYPTION='N';

Disable the general_log
SET PERSIST general_log = 'OFF';

Check Contents

Apply appropriate controls to protect the confidentiality and integrity of data at rest in the database.

Using SQL determine if all data-at-rest is encrypted.

SELECT VARIABLE_NAME, VARIABLE_VALUE
FROM performance_schema.global_variables where variable_name = 'audit_log_encryption';

If "audit_log_encryption" is not set to "AES", this is a finding.

SELECT VARIABLE_NAME, VARIABLE_VALUE
FROM performance_schema.global_variables where variable_name = 'binlog_encryption';

If "binlog_encrypt" is not set to "ON", this is a finding.

SELECT VARIABLE_NAME, VARIABLE_VALUE
FROM performance_schema.global_variables where variable_name = 'innodb_redo_log_encrypt';

If "innodb_redo_log_encrypt" is not set to "ON", this is a finding.

SELECT VARIABLE_NAME, VARIABLE_VALUE
FROM performance_schema.global_variables where variable_name = 'innodb_undo_log_encrypt';

If "innodb_undo_log_encrypt" is not set to "ON", this is a finding.

SELECT VARIABLE_NAME, VARIABLE_VALUE
FROM performance_schema.global_variables
WHERE VARIABLE_NAME like 'general_log';

If "general_log"is not "OFF", this is a finding.

Find encryption status for all mysql table and tablespaces.
SELECT
`INNODB_TABLESPACES`.`NAME`,
`INNODB_TABLESPACES`.`ENCRYPTION`
FROM `information_schema`.`INNODB_TABLESPACES`;

If any tablespace is not ENCRYPTION set to "Y (yes)", this is a finding.

SELECT VARIABLE_NAME, VARIABLE_VALUE
FROM performance_schema.global_variables where variable_name = 'table_encryption_privilege_check';

If "innodb_redo_log_encrypt" is not set to "ON", this is a finding.

Vulnerability Number

V-235155

Documentable

False

Rule Version

MYS8-00-007200

Severity Override Guidance

Apply appropriate controls to protect the confidentiality and integrity of data at rest in the database.

Using SQL determine if all data-at-rest is encrypted.

SELECT VARIABLE_NAME, VARIABLE_VALUE
FROM performance_schema.global_variables where variable_name = 'audit_log_encryption';

If "audit_log_encryption" is not set to "AES", this is a finding.

SELECT VARIABLE_NAME, VARIABLE_VALUE
FROM performance_schema.global_variables where variable_name = 'binlog_encryption';

If "binlog_encrypt" is not set to "ON", this is a finding.

SELECT VARIABLE_NAME, VARIABLE_VALUE
FROM performance_schema.global_variables where variable_name = 'innodb_redo_log_encrypt';

If "innodb_redo_log_encrypt" is not set to "ON", this is a finding.

SELECT VARIABLE_NAME, VARIABLE_VALUE
FROM performance_schema.global_variables where variable_name = 'innodb_undo_log_encrypt';

If "innodb_undo_log_encrypt" is not set to "ON", this is a finding.

SELECT VARIABLE_NAME, VARIABLE_VALUE
FROM performance_schema.global_variables
WHERE VARIABLE_NAME like 'general_log';

If "general_log"is not "OFF", this is a finding.

Find encryption status for all mysql table and tablespaces.
SELECT
`INNODB_TABLESPACES`.`NAME`,
`INNODB_TABLESPACES`.`ENCRYPTION`
FROM `information_schema`.`INNODB_TABLESPACES`;

If any tablespace is not ENCRYPTION set to "Y (yes)", this is a finding.

SELECT VARIABLE_NAME, VARIABLE_VALUE
FROM performance_schema.global_variables where variable_name = 'table_encryption_privilege_check';

If "innodb_redo_log_encrypt" is not set to "ON", this is a finding.

Check Content Reference

M

Target Key

5277

Comments