STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026: STIGQter: STIG Summary: Oracle Database 19c Security Technical Implementation Guide Version: 1 Release: 5 Benchmark Date: 01 Apr 2026:SV-270574r1192921_rule
V-270574
SRG-APP-000231-DB-000154
O19C-00-016800
CAT I
10
Apply appropriate controls to protect the confidentiality and integrity of data at rest in the database.
If no site-specific precautions are in place, use Oracle Advanced Security Option to encrypt data at rest.
If Oracle Advanced Security Option is not an option, use site-specific procedures to secure data at rest.
Review system documentation to determine whether the system handles classified information. If the system does not handle classified information, the severity of this check is downgraded to CAT II.
If the application owner and authorizing official (AO) have determined that encryption of data at rest is required, verify the data on secondary devices is encrypted.
If full-disk encryption is being used, this is not a finding.
If data encryption is required, verify that the data is encrypted before being put on the secondary device. To ensure that the appropriate controls are in place, discuss the precautions taken with the site database administrators (DBAs) and system administrators (SAs) and try to modify data at rest.
Oracle recommends using Transparent Data Encryption, which is part of Oracle Advanced Security Option, to protect data.
To verify the data is encrypted, upon an auditor's request, Oracle provides views that document the encryption status of the database. For TDE column encryption, use the view "dba_encrypted_columns", which lists the owner, table name, column name, encryption algorithm, and salt for all encrypted columns. For TDE tablespace encryption, the following SQL statement lists all encrypted tablespaces with their encryption algorithm and corresponding, encrypted, data files. Issue the following commands to verify the data at rest is encrypted.
$ sqlplus connect as sysdba
SQL> SELECT t.name "TSName",
e.encryptionalg "Algorithm",
d.file_name "File Name"
FROM v$tablespace t,
v$encrypted_tablespaces e,
dba_data_files d
WHERE t.ts# = e.ts#
and t.name = d.tablespace_name;
The next SQL statement lists the table owner, tables within encrypted tablespaces, and the encryption algorithm:
SQL> SELECT a.owner "Owner",
a.table_name "Table Name",
e.encryptionalg "Algorithm"
FROM dba_tables a,
v$encrypted_tablespaces e
WHERE a.tablespace_name in (select t.name from v$tablespace t, v$encrypted_tablespaces e where t.ts# = e.ts#);
For each database where encryption is required, verify that encryption is in effect. If it is not, this is a finding.
V-270574
False
O19C-00-016800
Review system documentation to determine whether the system handles classified information. If the system does not handle classified information, the severity of this check is downgraded to CAT II.
If the application owner and authorizing official (AO) have determined that encryption of data at rest is required, verify the data on secondary devices is encrypted.
If full-disk encryption is being used, this is not a finding.
If data encryption is required, verify that the data is encrypted before being put on the secondary device. To ensure that the appropriate controls are in place, discuss the precautions taken with the site database administrators (DBAs) and system administrators (SAs) and try to modify data at rest.
Oracle recommends using Transparent Data Encryption, which is part of Oracle Advanced Security Option, to protect data.
To verify the data is encrypted, upon an auditor's request, Oracle provides views that document the encryption status of the database. For TDE column encryption, use the view "dba_encrypted_columns", which lists the owner, table name, column name, encryption algorithm, and salt for all encrypted columns. For TDE tablespace encryption, the following SQL statement lists all encrypted tablespaces with their encryption algorithm and corresponding, encrypted, data files. Issue the following commands to verify the data at rest is encrypted.
$ sqlplus connect as sysdba
SQL> SELECT t.name "TSName",
e.encryptionalg "Algorithm",
d.file_name "File Name"
FROM v$tablespace t,
v$encrypted_tablespaces e,
dba_data_files d
WHERE t.ts# = e.ts#
and t.name = d.tablespace_name;
The next SQL statement lists the table owner, tables within encrypted tablespaces, and the encryption algorithm:
SQL> SELECT a.owner "Owner",
a.table_name "Table Name",
e.encryptionalg "Algorithm"
FROM dba_tables a,
v$encrypted_tablespaces e
WHERE a.tablespace_name in (select t.name from v$tablespace t, v$encrypted_tablespaces e where t.ts# = e.ts#);
For each database where encryption is required, verify that encryption is in effect. If it is not, this is a finding.
M
5672