Oracle Database 12c Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-APP-000516-DB-000363
Group -
SRG-APP-000516-DB-000363
Group -
Oracle instance names must not contain Oracle version numbers.
Service names may be discovered by unauthenticated users. If the service name includes version numbers or other database product information, a malicious user may use that information to develop a ...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Fixed user and public database links must be authorized for use.
Database links define connections that may be used by the local database to access remote Oracle databases. These links provide a means for a compromise to the local database to spread to remote da...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
A minimum of two Oracle control files must be defined and configured to be stored on separate, archived disks (physical or virtual) or archived partitions on a RAID device.
Oracle control files are used to store information critical to Oracle database integrity. Oracle uses these files to maintain time synchronization of database files as well as at system startup to ...Rule Low Severity -
SRG-APP-000516-DB-000363
Group -
A minimum of two Oracle redo log groups/files must be defined and configured to be stored on separate, archived physical disks or archived directories on a RAID device.
The Oracle redo log files store the detailed information on changes made to the database. This information is critical to database recovery in case of a database failure.Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
The Oracle WITH GRANT OPTION privilege must not be granted to non-DBA or non-Application administrator user accounts.
An account permission to grant privileges within the database is an administrative function. Minimizing the number and privileges of administrative accounts reduces the chances of privileged accoun...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
SRG-APP-000516-DB-000363
Group -
The Oracle REMOTE_OS_ROLES parameter must be set to FALSE.
Setting REMOTE_OS_ROLES to TRUE allows operating system groups to control Oracle roles. The default value of FALSE causes roles to be identified and managed by the database. If REMOTE_OS_ROLES is s...Rule High Severity -
SRG-APP-000516-DB-000363
Group -
SRG-APP-000516-DB-000363
Group -
The Oracle password file ownership and permissions should be limited and the REMOTE_LOGIN_PASSWORDFILE parameter must be set to EXCLUSIVE or NONE.
It is critically important to the security of your system that you protect your password file and the environment variables that identify the location of the password file. Any user with access to ...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
System privileges granted using the WITH ADMIN OPTION must not be granted to unauthorized user accounts.
The WITH ADMIN OPTION allows the grantee to grant a privilege to another database account. Best security practice restricts the privilege of assigning privileges to authorized personnel. Authorized...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
SRG-APP-000516-DB-000363
Group -
Oracle roles granted using the WITH ADMIN OPTION must not be granted to unauthorized accounts.
The WITH ADMIN OPTION allows the grantee to grant a role to another database account. Best security practice restricts the privilege of assigning privileges to authorized personnel. Authorized pers...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Object permissions granted to PUBLIC must be restricted.
Permissions on objects may be granted to the user group PUBLIC. Because every database user is a member of the PUBLIC group, granting object permissions to PUBLIC gives all users in the database ac...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
The Oracle Listener must be configured to require administration authentication.
Oracle listener authentication helps prevent unauthorized administration of the Oracle listener. Unauthorized administration of the listener could lead to DoS exploits; loss of connection audit dat...Rule High Severity -
SRG-APP-000516-DB-000363
Group -
Application role permissions must not be assigned to the Oracle PUBLIC role.
Permissions granted to PUBLIC are granted to all users of the database. Custom roles must be used to assign application permissions to functional groups of application users. The installation of Or...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
SRG-APP-000516-DB-000363
Group -
Connections by mid-tier web and application systems to the Oracle DBMS from a DMZ or external network must be encrypted.
Multi-tier systems may be configured with the database and connecting middle-tier system located on an internal network, with the database located on an internal network behind a firewall and the m...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Database job/batch queues must be reviewed regularly to detect unauthorized database job submissions.
Unauthorized users may bypass security mechanisms by submitting jobs to job queues managed by the database to be run under a more privileged security context of the database or host system. These q...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
SRG-APP-000516-DB-000363
Group -
Sensitive information from production database exports must be modified before import to a development database.
Data export from production databases may include sensitive data. Application developers do not have a need to know to sensitive data. Any access they may have to production data would be considere...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Only authorized system accounts must have the SYSTEM tablespace specified as the default tablespace.
The Oracle SYSTEM tablespace is used by the database to store all DBMS system objects. Other use of the system tablespace may compromise system availability and the effectiveness of host system acc...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
SRG-APP-000516-DB-000363
Group -
The directories assigned to the LOG_ARCHIVE_DEST* parameters must be protected from unauthorized access.
The LOG_ARCHIVE_DEST parameter is used to specify the directory to which Oracle archive logs are written. Where the DBMS availability and recovery to a specific point in time is critical, the prote...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
SRG-APP-000516-DB-000363
Group -
SRG-APP-000516-DB-000363
Group -
Use of the DBMS installation account must be logged.
The DBMS installation account may be used by any authorized user to perform DBMS installation or maintenance. Without logging, accountability for actions attributed to the account is lost.Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
SRG-APP-000516-DB-000363
Group -
SRG-APP-000516-DB-000363
Group -
Access to DBMS software files and directories must not be granted to unauthorized users.
The DBMS software libraries contain the executables used by the DBMS to operate. Unauthorized access to the libraries can result in malicious alteration or planting of operational executables. This...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.