STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:

Oracle Database must protect against an individual who uses a shared account falsely denying having performed a particular action.

DISA Rule

SV-270501r1167736_rule

Vulnerability Number

V-270501

Group Title

SRG-APP-000080-DB-000063

Rule Version

O19C-00-001700

Severity

CAT III

CCI(s)

• CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
• CCI-004045 - Require users to be individually authenticated before granting access to the shared accounts or resources.

Weight

10

Fix Recommendation

Use accounts assigned to individual users. Configure DBMS to provide individual accountability at the DBMS level, and in audit logs, for actions performed under a shared database account.

Modify applications and data tables that are not capturing individual user identity to do so.

Create and enforce the use of individual user IDs for logging on to Oracle tools and third-party products.

If Oracle auditing is not already enabled, enable it.

If Standard Auditing is used:
If Oracle (or third-party) auditing is not already enabled, enable it. For Oracle auditing, use this query:

ALTER SYSTEM SET AUDIT_TRAIL=<audit trail type> SID='*' SCOPE=SPFILE;

Audit trail type can be 'OS', 'DB', 'DB,EXTENDED', 'XML' or 'XML,EXTENDED'.

After executing this statement, it may be necessary to shut down and restart the Oracle database.

If Unified Auditing is used:
Link the oracle binary with uniaud_on, and then restart the database. Oracle Database Upgrade Guide describes how to enable unified auditing.

For more information on the configuration of auditing, refer to the following documents:

"Auditing Database Activity" in the Oracle Database 19c Security Guide:
https://docs.oracle.com/en/database/oracle/oracle-database/19/dbseg/index.html

"Monitoring Database Activity with Auditing" in the Oracle Database Security Guide:
https://docs.oracle.com/en/database/oracle/oracle-database/19/dbseg/index.html

"DBMS_AUDIT_MGMT" in the Oracle Database PL/SQL Packages and Types Reference:
https://docs.oracle.com/en/database/oracle/oracle-database/19/arpls/

Oracle Database Upgrade Guide:
https://docs.oracle.com/en/database/oracle/oracle-database/19/upgrd/index.html

If the site-specific audit requirements are not covered by the default audit options, deploy and configure Fine-Grained Auditing. For details, refer to Oracle documentation at the locations above.

If this level of auditing does not meet site-specific requirements, consider deploying the Oracle Audit Vault. The Audit Vault is a highly configurable option from Oracle made specifically for performing the audit functions. It has reporting capabilities as well as user-defined rules that provide additional flexibility for complex auditing requirements.

Check Contents

If there are no shared accounts available to more than one user, this is not a finding.

Review database, application, and/or OS settings to determine whether users can be identified as individuals when using shared accounts.

If the individual user of a shared account cannot be identified, this is a finding.

If Standard Auditing is used:
To ensure user activities other than SELECT, INSERT, UPDATE, and DELETE are also monitored and attributed to individuals, verify that Oracle auditing is enabled. To verify Oracle is configured to capture audit data, enter the following SQL*Plus command:

SHOW PARAMETER AUDIT_TRAIL

Or run the following SQL query:

col display_value format a10
col default_value format a10
SELECT inst_id, con_id, display_value, default_value, isdefault
FROM sys.gv_$parameter WHERE name = 'audit_trail';

If the query returns the display_value "NONE", for any instance or container, this is a finding.

If Unified Auditing is used:
To ensure that user activities other than SELECT, INSERT, UPDATE, and DELETE are also monitored and attributed to individuals, verify that Oracle auditing is enabled. To verify Oracle is configured to capture audit data, enter the following SQL*Plus query:

col value format a10
SELECT inst_id, con_id, value
FROM sys.gv_$option
WHERE parameter = 'Unified Auditing';

If the query returns something other than "TRUE", for any instance or container, this is a finding.

Vulnerability Number

V-270501

Documentable

False

Rule Version

O19C-00-001700

Severity Override Guidance

If there are no shared accounts available to more than one user, this is not a finding.

Review database, application, and/or OS settings to determine whether users can be identified as individuals when using shared accounts.

If the individual user of a shared account cannot be identified, this is a finding.

If Standard Auditing is used:
To ensure user activities other than SELECT, INSERT, UPDATE, and DELETE are also monitored and attributed to individuals, verify that Oracle auditing is enabled. To verify Oracle is configured to capture audit data, enter the following SQL*Plus command:

SHOW PARAMETER AUDIT_TRAIL

Or run the following SQL query:

col display_value format a10
col default_value format a10
SELECT inst_id, con_id, display_value, default_value, isdefault
FROM sys.gv_$parameter WHERE name = 'audit_trail';

If the query returns the display_value "NONE", for any instance or container, this is a finding.

If Unified Auditing is used:
To ensure that user activities other than SELECT, INSERT, UPDATE, and DELETE are also monitored and attributed to individuals, verify that Oracle auditing is enabled. To verify Oracle is configured to capture audit data, enter the following SQL*Plus query:

col value format a10
SELECT inst_id, con_id, value
FROM sys.gv_$option
WHERE parameter = 'Unified Auditing';

If the query returns something other than "TRUE", for any instance or container, this is a finding.

Check Content Reference

M

Target Key

5672