Oracle MySQL 8.0 Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-APP-000176-DB-000068
Group -
The MySQL Database Server 8.0 must enforce authorized access to all PKI private keys stored/utilized by the MySQL Database Server 8.0.
The DoD standard for authentication is DoD-approved PKI certificates. PKI certificate-based authentication is performed by requiring the certificate holder to cryptographically prove possession of ...Rule High Severity -
SRG-APP-000177-DB-000069
Group -
The MySQL Database Server 8.0 must map the PKI-authenticated identity to an associated user account.
The DoD standard for authentication is DoD-approved PKI certificates. Once a PKI certificate has been validated, it must be mapped to a Database Management System (DBMS) user account for the authen...Rule Medium Severity -
SRG-APP-000164-DB-000401
Group -
If Database Management System (DBMS) authentication using passwords is employed, the DBMS must enforce the DOD standards for password complexity and lifetime.
OS/enterprise authentication and identification must be used (SRG-APP-000023-DB-000001). Native DBMS authentication may be used only when circumstances make it unavoidable; and must be documented a...Rule High Severity -
SRG-APP-000171-DB-000074
Group -
SRG-APP-000092-DB-000208
Group -
SRG-APP-000172-DB-000075
Group -
If passwords are used for authentication, the MySQL Database Server 8.0 must transmit only encrypted representations of passwords.
The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and require...Rule High Severity -
SRG-APP-000178-DB-000083
Group -
The MySQL Database Server 8.0 must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.
The DoD standard for authentication is DoD-approved PKI certificates. Normally, with PKI authentication, the interaction with the user for authentication will be handled by a software component se...Rule High Severity -
SRG-APP-000033-DB-000084
Group -
The MySQL Database Server 8.0 must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
Authentication with a DoD-approved PKI certificate does not necessarily imply authorization to access the Database Management System (DBMS). To mitigate the risk of unauthorized access to sensitive...Rule High Severity -
SRG-APP-000516-DB-000363
Group -
The MySQL Database Server 8.0 must initiate session auditing upon startup.
Session auditing is for use when a user's activities are under investigation. To be sure of capturing all activity during those periods when session auditing is in use, it needs to be in operation ...Rule Medium Severity -
SRG-APP-000121-DB-000202
Group -
SRG-APP-000141-DB-000090
Group -
Default demonstration and sample databases, database objects, and applications must be removed.
Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizatio...Rule Medium Severity -
SRG-APP-000141-DB-000091
Group -
Unused database components, MySQL Database Server 8.0 software, and database objects must be removed.
Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizatio...Rule Medium Severity -
SRG-APP-000141-DB-000092
Group -
SRG-APP-000142-DB-000094
Group -
SRG-APP-000148-DB-000103
Group -
The MySQL Database Server 8.0 must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
To ensure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. Organizational use...Rule Medium Severity -
SRG-APP-000179-DB-000114
Group -
The MySQL Database Server 8.0 must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for cryptographic operations.
Use of weak or not validated cryptographic algorithms undermines the purposes of utilizing encryption and digital signatures to protect data. Weak algorithms can be easily broken and not validated ...Rule High Severity -
SRG-APP-000180-DB-000115
Group -
The MySQL Database Server 8.0 must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).
Non-organizational users include all information system users other than organizational users, which include organizational employees or individuals the organization deems to have equivalent status...Rule Medium Severity -
SRG-APP-000211-DB-000122
Group -
SRG-APP-000233-DB-000124
Group -
The MySQL Database Server 8.0 must isolate security functions from non-security functions.
An isolation boundary provides access control and protects the integrity of the hardware, software, and firmware that perform security functions. Security functions are the hardware, software, an...Rule Medium Severity -
SRG-APP-000243-DB-000128
Group -
SRG-APP-000243-DB-000374
Group -
Access to database files must be limited to relevant processes and to authorized, administrative users.
Applications, including DBMSs, must prevent unauthorized and unintended information transfer via shared system resources. Permitting only DBMS processes and authorized, administrative users to have...Rule Medium Severity -
SRG-APP-000224-DB-000384
Group -
SRG-APP-000231-DB-000154
Group -
The MySQL Database Server 8.0 must protect the confidentiality and integrity of all information at rest.
This control is intended to address the confidentiality and integrity of information at rest in non-mobile devices and covers user information and system information. Information at rest refers to ...Rule High Severity -
SRG-APP-000251-DB-000160
Group -
SRG-APP-000251-DB-000391
Group -
The MySQL Database Server 8.0 and associated applications must reserve the use of dynamic code execution for situations that require it.
With respect to database management systems, one class of threat is known as SQL Injection, or more generally, code injection. It takes advantage of the dynamic execution capabilities of various pr...Rule Medium Severity -
SRG-APP-000251-DB-000392
Group -
The MySQL Database Server 8.0 and associated applications, when making use of dynamic code execution, must scan input data for invalid values that may indicate a code injection attack.
With respect to database management systems, one class of threat is known as SQL Injection, or more generally, code injection. It takes advantage of the dynamic execution capabilities of various pr...Rule Medium Severity -
SRG-APP-000122-DB-000203
Group -
The MySQL Database Server 8.0 must protect its audit configuration from unauthorized modification.
Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on au...Rule Medium Severity -
SRG-APP-000123-DB-000204
Group -
The MySQL Database Server 8.0 must protect its audit features from unauthorized removal.
Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on au...Rule Medium Severity -
SRG-APP-000133-DB-000179
Group -
The MySQL Database Server 8.0 must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to the MySQL Database Server 8.0.
If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robus...Rule Medium Severity -
SRG-APP-000133-DB-000198
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.