Redis Enterprise 6.x Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-APP-000360-DB-000320
Group -
SRG-APP-000109-DB-000049
Group -
SRG-APP-000109-DB-000321
Group -
Redis Enterprise DBMS must be configurable to overwrite audit log records, oldest first (First-In-First-Out [FIFO]), in the event of unavailability of space for more audit log records.
It is critical that when the DBMS is at risk of failing to process audit logs as required, it take action to mitigate the failure. Audit processing failures include software/hardware errors; failur...Rule Medium Severity -
SRG-APP-000374-DB-000322
Group -
Redis Enterprise DBMS must record time stamps, in audit records and application data, that can be mapped to Coordinated Universal Time (UTC, formerly GMT).
If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis. Time stamps generated by the DBMS must include date and time. Time ...Rule Medium Severity -
SRG-APP-000118-DB-000059
Group -
The audit information produced by Redis Enterprise DBMS must be protected from unauthorized read access.
If audit data were to become compromised, competent forensic analysis and discovery of the true source of potentially malicious system activity would be difficult, if not impossible, to achieve. In...Rule Medium Severity -
SRG-APP-000119-DB-000060
Group -
SRG-APP-000120-DB-000061
Group -
The audit information produced by Redis Enterprise DBMS must be protected from unauthorized deletion.
If audit data were to become compromised, competent forensic analysis and discovery of the true source of potentially malicious system activity would be impossible to achieve. To ensure the veraci...Rule Medium Severity -
SRG-APP-000121-DB-000202
Group -
Redis Enterprise DBMS must protect its audit features from unauthorized access.
Redis Enterprise does not come with unique tools to view log data and logging is not configurable. Logs are stored in a standard log file on the host operating system that is accessible using stand...Rule Medium Severity -
SRG-APP-000122-DB-000203
Group -
SRG-APP-000123-DB-000204
Group -
SRG-APP-000378-DB-000365
Group -
Redis Enterprise DBMS must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status.
Redis Enterprise permits the installation of logic modules through a control plane layer to the database, which requires privilege access to the control plane. This is provisioned for support durin...Rule Medium Severity -
SRG-APP-000380-DB-000360
Group -
Redis Enterprise DBMS must enforce access restrictions associated with changes to the configuration of Redis Enterprise DBMS or database(s).
Failure to provide logical access restrictions associated with changes to configuration may have significant effects on the overall security of the system. When dealing with access restrictions p...Rule Medium Severity -
SRG-APP-000133-DB-000179
Group -
SRG-APP-000133-DB-000198
Group -
Redis Enterprise DBMS must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.
Use of nonsecure network functions, ports, protocols, and services exposes the system to avoidable threats.Rule Medium Severity -
SRG-APP-000141-DB-000091
Group -
SRG-APP-000133-DB-000199
Group -
Database software, including DBMS configuration files, must be stored in dedicated directories, or DASD pools, separate from the host OS and other applications.
When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have signi...Rule Medium Severity -
SRG-APP-000133-DB-000362
Group -
The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to Redis Enterprise DBMS, etc.) must be restricted to authorized users.
If the DBMS were to allow any user to make changes to database structure or logic, those changes might be implemented without undergoing the appropriate testing and approvals that are part of a rob...Rule Medium Severity -
SRG-APP-000516-DB-000363
Group -
Redis Enterprise DBMS must be configured in accordance with the security configuration settings based on DoD security configuration and implementation guidance, including STIGs, NSA configuration guides, CTOs, DTMs, and IAVMs.
Configuring the DBMS to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline acros...Rule Medium Severity -
SRG-APP-000383-DB-000364
Group -
SRG-APP-000141-DB-000092
Group -
SRG-APP-000141-DB-000093
Group -
Access to external executables must be disabled or restricted.
Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizatio...Rule Medium Severity -
SRG-APP-000142-DB-000094
Group -
Redis Enterprise DBMS must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
To prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restr...Rule Medium Severity -
SRG-APP-000389-DB-000372
Group -
SRG-APP-000148-DB-000103
Group -
Redis Enterprise DBMS must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
Redis Enterprise allows the user to configure unique users per role. Review roles and ensure roles use unique organizational principles per user to the database. Redis does come with a default user...Rule Medium Severity -
SRG-APP-000171-DB-000074
Group -
SRG-APP-000400-DB-000367
Group -
Redis Enterprise DBMS must prohibit the use of cached authenticators after an organization-defined time period.
If cached authentication information is out of date, the validity of the authentication information may be questionable. For more information on configuring time out periods on Redis Enterprise re...Rule Medium Severity -
SRG-APP-000175-DB-000067
Group -
Redis Enterprise DBMS, when utilizing PKI-based authentication, must validate certificates by performing RFC 5280-compliant certification path validation.
The DoD standard for authentication is DoD-approved PKI certificates. A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA)....Rule Medium Severity -
SRG-APP-000176-DB-000068
Group -
SRG-APP-000177-DB-000069
Group -
Redis Enterprise DBMS must map the PKI-authenticated identity to an associated user account.
The DoD standard for authentication is DoD-approved PKI certificates. Once a PKI certificate has been validated, it must be mapped to a DBMS user account for the authenticated identity to be meanin...Rule Medium Severity -
SRG-APP-000178-DB-000083
Group -
Redis Enterprise DBMS must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.
The DoD standard for authentication is DoD-approved PKI certificates. Normally, with PKI authentication, the interaction with the user for authentication will be handled by a software component se...Rule High Severity -
SRG-APP-000179-DB-000114
Group -
Redis Enterprise DBMS must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for cryptographic operations.
Use of weak or not validated cryptographic algorithms undermines the purposes of utilizing encryption and digital signatures to protect data. Weak algorithms can be easily broken and not validated ...Rule High Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.