Oracle Database 11g Installation STIG

Version: 9

Updated: 22 Oct 2021

Findings: 86

Findings

V-2420 - Database executable and configuration files should be monitored for unauthorized modifications. (low)
V-2422 - The DBMS software installation account should be restricted to authorized users. (medium)
V-2423 - Database software, applications and configuration files should be monitored to discover unauthorized changes. (medium)
V-2608 - The Oracle Listener should be configured to require administration authentication. (high)
V-2612 - Oracle SQLNet and listener log files should not be accessible to unauthorized users. (medium)
V-3440 - Connections by mid-tier web and application systems to the Oracle DBMS should be protected, encrypted and authenticated according to database, web, application, enclave and network requirements. (medium)
V-3497 - The Oracle Listener ADMIN_RESTRICTIONS parameter if present should be set to ON. (medium)
V-3726 - Configuration management procedures should be defined and implemented for database software modifications. (low)
V-3728 - Unused database components, database application software, and database objects should be removed from the DBMS system. (low)
V-3803 - A production DBMS installation should not coexist on the same DBMS host with other, non-production DBMS installations. (medium)
V-3805 - Application software should be owned by a Software Application account. (low)
V-3806 - A baseline of database application software should be documented and maintained. (medium)
V-3807 - All applications that access the database should be logged in the audit trail. (medium)
V-3809 - A single database connection configuration file should not be used to configure all database clients. (medium)
V-3811 - Procedures for establishing temporary passwords that meet DoD password requirements for new accounts should be defined, documented and implemented. (medium)
V-3812 - Database account passwords should be stored in encoded or encrypted format whether stored in database objects, external host files, environment variables or any other storage locations. (high)
V-3813 - DBMS tools or applications that echo or require a password entry in clear text should be protected from password display. (medium)
V-3825 - Remote adminstrative connections to the database should be encrypted. (medium)
V-3827 - Audit trail data should be reviewed daily or more frequently. (medium)
V-3842 - The Oracle software installation account should not be granted excessive host system privileges. (medium)
V-3845 - OS DBA group membership should be restricted to authorized accounts. (low)
V-3862 - The Oracle INBOUND_CONNECT_TIMEOUT and SQLNET.INBOUND_CONNECT_TIMEOUT parameters should be set to a value greater than 0. (medium)
V-3863 - The Oracle SQLNET.EXPIRE_TIME parameter should be set to a value greater than 0. (medium)
V-3866 - The Oracle Management Agent should be uninstalled if not required and authorized or is installed on a database accessible from the Internet. (low)
V-4754 - Database software directories including DBMS configuration files are stored in dedicated directories separate from the host OS and other applications. (medium)
V-5658 - Vendor supported software is evaluated and patched against newly found vulnerabilities. (high)
V-5659 - The latest security patches should be installed. (medium)
V-6756 - Only necessary privileges to the host system should be granted to DBA OS accounts. (medium)
V-6767 - The database should be secured in accordance with DoD, vendor and/or commercially accepted practices where applicable. (medium)
V-15102 - Automated notification of suspicious activity detected in the audit trail should be implemented. (medium)
V-15103 - An automated tool that monitors audit data and immediately reports suspicious activity should be employed for the DBMS. (medium)
V-15104 - Sensitive data served by the DBMS should be protected by encryption when transmitted across the network. (high)
V-15105 - Unauthorized access to external database objects should be removed from application user roles. (medium)
V-15106 - DBA roles should be periodically monitored to detect assignment of unauthorized or excess privileges. (medium)
V-15107 - DBMS privileges to restore database data or other DBMS configurations, features, or objects should be restricted to authorized DBMS accounts. (medium)
V-15108 - Privileges assigned to developers on shared production and development DBMS hosts and the DBMS should be monitored every three months or more frequently for unauthorized changes. (medium)
V-15109 - DBMS production application and data directories should be protected from developers on shared production/development DBMS host systems. (medium)
V-15110 - Use of the DBMS installation account should be logged. (medium)
V-15111 - Use of the DBMS software installation account should be restricted to DBMS software installation, upgrade and maintenance actions. (medium)
V-15112 - The DBMS should be periodically tested for vulnerability management and IA compliance. (low)
V-15116 - The DBMS host platform and other dependent applications should be configured in compliance with applicable STIG requirements. (medium)
V-15117 - The DBMS audit logs should be included in backup operations. (medium)
V-15118 - Remote administrative access to the database should be monitored by the IAO or IAM. (medium)
V-15120 - DBMS backup and restoration files should be protected from unauthorized access. (medium)
V-15121 - DBMS software libraries should be periodically backed up. (medium)
V-15122 - The database should not be directly accessible from public or unauthorized networks. (medium)
V-15126 - Database backup procedures should be defined, documented and implemented. (medium)
V-15127 - The IAM should review changes to DBA role assignments. (medium)
V-15129 - Backup and recovery procedures should be developed, documented, implemented and periodically tested. (medium)
V-15131 - Sensitive information stored in the database should be protected by encryption. (medium)
V-15132 - Database data files containing sensitive information should be encrypted. (medium)
V-15138 - The DBMS IA policies and procedures should be reviewed annually or more frequently. (low)
V-15139 - Plans and procedures for testing DBMS installations, upgrades and patches should be defined and followed prior to production implementation. (medium)
V-15140 - Procedures and restrictions for import of production data to development databases should be documented, implemented and followed. (medium)
V-15143 - Database data encryption controls should be configured in accordance with application requirements. (medium)
V-15144 - Sensitive data is stored in the database and should be identified in the System Security Plan and AIS Functional Architecture documentation. (medium)
V-15145 - The DBMS restoration priority should be assigned. (low)
V-15146 - The DBMS should not be operated without authorization on a host system supporting other application services. (medium)
V-15148 - DBMS network communications should comply with PPS usage restrictions. (medium)
V-15150 - The DBMS requires a System Security Plan containing all required information. (low)
V-15179 - The DBMS should not share a host supporting an independent security service. (medium)
V-15608 - Access to DBMS software files and directories should not be granted to unauthorized users. (medium)
V-15611 - The audit logs should be periodically monitored to discover DBMS access using unauthorized applications. (low)
V-15618 - Access to external DBMS executables should be disabled or restricted. (medium)
V-15620 - OS accounts used to execute external procedures should be assigned minimum privileges. (medium)
V-15621 - Network access to the DBMS must be restricted to authorized personnel. (medium)
V-15622 - DBMS service identification should be unique and clearly identifies the service. (low)
V-15625 - Recovery procedures and technical system features exist to ensure that recovery is done in a secure and verifiable manner. (medium)
V-15636 - Passwords should be encrypted when transmitted across the network. (high)
V-15643 - Access to DBMS security data should be audited. (medium)
V-15649 - The DBMS should have configured all applicable settings to use trusted files, functions, features, or other components during startup, shutdown, aborts, or other unplanned interruptions. (medium)
V-15651 - Remote DBMS administration should be documented and authorized or disabled. (medium)
V-15652 - DBMS remote administration should be audited. (medium)
V-15656 - The DBMS should not have a connection defined to access or be accessed by a DBMS at a different classification level. (medium)
V-15659 - Credentials used to access remote databases should be protected by encryption and restricted to authorized users. (medium)
V-15662 - Remote administration of the DBMS should be restricted to known, dedicated and encrypted network addresses and ports. (medium)
V-16031 - The Oracle listener.ora file should specify IP addresses rather than host names to identify hosts. (low)
V-16032 - Remote administration should be disabled for the Oracle connection manager. (medium)
V-16054 - The Oracle SEC_PROTOCOL_ERROR_TRACE_ACTION parameter should not be set to NONE. (medium)
V-16055 - Oracle Application Express or Oracle HTML DB should not be installed on a production database. (medium)
V-16056 - Oracle Configuration Manager should not remain installed on a production system. (medium)
V-16057 - The SQLNet SQLNET.ALLOWED_LOGON_VERSION parameter must be set to a value of 11 or higher. (medium)
V-43137 - DBMS cryptography must be NIST FIPS 140-2 validated. (medium)
V-57609 - The directory assigned to the AUDIT_FILE_DEST parameter must be protected from unauthorized access and must be stored in a dedicated directory or disk partition separate from software or other application files. (medium)
V-57611 - A minimum of two Oracle control files must be defined and configured to be stored on separate, archived disks (physical or virtual) or archived partitions on a RAID device. (low)
V-57613 - A minimum of two Oracle redo log groups/files must be defined and configured to be stored on separate, archived physical disks or archived directories on a RAID device. (medium)