Oracle Database 11.2g Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
The DBMS must enforce password maximum lifetime restrictions.
Password maximum lifetime is the maximum period of time, (typically in days) a user's password may be in effect before the user is forced to change it. Passwords need to be changed at specific pol...Rule Medium Severity -
The DBMS must implement required cryptographic protections using cryptographic modules complying with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.
Use of cryptography to provide confidentiality and non-repudiation is not effective unless strong methods are employed. Many earlier encryption methods and modules have been broken and/or overtaken...Rule Medium Severity -
The DBMS must support taking organization-defined list of least disruptive actions to terminate suspicious events.
System availability is a key tenet of system security. Organizations need to have the flexibility to be able to define the automated actions taken in response to an identified incident. This includ...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Access to default accounts used to support replication must be restricted to authorized DBAs.
Replication database accounts are used for database connections between databases. Replication requires the configuration of these accounts using the same username and password on all databases par...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Oracle instance names must not contain Oracle version numbers.
Service names may be discovered by unauthenticated users. If the service name includes version numbers or other database product information, a malicious user may use that information to develop a ...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
SRG-APP-000516-DB-000363
Group -
SRG-APP-000516-DB-000363
Group -
A minimum of two Oracle redo log groups/files must be defined and configured to be stored on separate, archived physical disks or archived directories on a RAID device.
The Oracle redo log files store the detailed information on changes made to the database. This information is critical to database recovery in case of a database failure.Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
The Oracle WITH GRANT OPTION privilege must not be granted to non-DBA or non-Application administrator user accounts.
An account permission to grant privileges within the database is an administrative function. Minimizing the number and privileges of administrative accounts reduces the chances of privileged accoun...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
SRG-APP-000516-DB-000363
Group -
The Oracle REMOTE_OS_AUTHENT parameter must be set to FALSE.
Setting this value to TRUE allows operating system authentication over an unsecured connection. Trusting remote operating systems can allow a user to impersonate another operating system user and c...Rule High Severity -
SRG-APP-000516-DB-000363
Group -
The Oracle REMOTE_OS_ROLES parameter must be set to FALSE.
Setting REMOTE_OS_ROLES to TRUE allows operating system groups to control Oracle roles. The default value of FALSE causes roles to be identified and managed by the database. If REMOTE_OS_ROLES is s...Rule High Severity -
SRG-APP-000516-DB-000363
Group -
SRG-APP-000516-DB-000363
Group -
The Oracle password file ownership and permissions should be limited and the REMOTE_LOGIN_PASSWORDFILE parameter must be set to EXCLUSIVE or NONE.
It is critically important to the security of your system that you protect your password file and the environment variables that identify the location of the password file. Any user with access to ...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
System privileges granted using the WITH ADMIN OPTION must not be granted to unauthorized user accounts.
The WITH ADMIN OPTION allows the grantee to grant a privilege to another database account. Best security practice restricts the privilege of assigning privileges to authorized personnel. Authorized...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
SRG-APP-000516-DB-000363
Group -
Oracle roles granted using the WITH ADMIN OPTION must not be granted to unauthorized accounts.
The WITH ADMIN OPTION allows the grantee to grant a role to another database account. Best security practice restricts the privilege of assigning privileges to authorized personnel. Authorized pers...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
SRG-APP-000516-DB-000363
Group -
The Oracle Listener must be configured to require administration authentication.
Oracle listener authentication helps prevent unauthorized administration of the Oracle listener. Unauthorized administration of the listener could lead to DoS exploits; loss of connection audit dat...Rule High Severity -
SRG-APP-000516-DB-000363
Group -
Application role permissions must not be assigned to the Oracle PUBLIC role.
Application roles have been granted to PUBLIC. Permissions granted to PUBLIC are granted to all users of the database. Custom roles should be used to assign application permissions to functional gr...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Oracle application administration roles must be disabled if not required and authorized.
Application administration roles, which are assigned system or elevated application object privileges, should be protected from default activation. Application administration roles are determined b...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Connections by mid-tier web and application systems to the Oracle DBMS from a DMZ or external network must be encrypted.
Multi-tier systems may be configured with the database and connecting middle-tier system located on an internal network, with the database located on an internal network behind a firewall and the m...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Database job/batch queues must be reviewed regularly to detect unauthorized database job submissions.
Unauthorized users may bypass security mechanisms by submitting jobs to job queues managed by the database to be run under a more privileged security context of the database or host system. These q...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
SRG-APP-000516-DB-000363
Group -
Sensitive information from production database exports must be modified before being imported into a development database.
Data export from production databases may include sensitive data. Application developers do not have a need to know to sensitive data. Any access they may have to production data would be considere...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Only authorized system accounts must have the SYSTEM tablespace specified as the default tablespace.
The Oracle SYSTEM tablespace is used by the database to store all DBMS system objects. Other use of the system tablespace may compromise system availability and the effectiveness of host system acc...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Application owner accounts must have a dedicated application tablespace.
Separation of tablespaces by application helps to protect the application from resource contention and unauthorized access that could result from storage space reuses or host system access controls...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
The directories assigned to the LOG_ARCHIVE_DEST* parameters must be protected from unauthorized access.
The LOG_ARCHIVE_DEST parameter is used to specify the directory to which Oracle archive logs are written. Where the DBMS availability and recovery to a specific point in time is critical, the prote...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
The Oracle _TRACE_FILES_PUBLIC parameter if present must be set to FALSE.
The _TRACE_FILES_PUBLIC parameter is used to make trace files used for debugging database applications and events available to all database users. Use of this capability precludes the discrete assi...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
SRG-APP-000516-DB-000363
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.