Skip to content
ATO Pathways
Log In
Overview
Search
Catalogs
SCAP
OSCAL
Catalogs
Profiles
Documents
References
Knowledge Base
Platform Documentation
Compliance Dictionary
Platform Changelog
About
Catalogs
XCCDF
EDB Postgres Advanced Server v11 on Windows Security Technical Implementation Guide
SRG-APP-000091-DB-000066
SRG-APP-000091-DB-000066
An XCCDF Group - A logical subset of the XCCDF Benchmark
Details
Profiles
Prose
SRG-APP-000091-DB-000066
1 Rule
<GroupDescription></GroupDescription>
The EDB Postgres Advanced Server must generate audit records for DoD-defined auditable events.
Medium Severity
<VulnDiscussion>The EDB Postgres Advanced Server must generate audit records for DoD-defined auditable events within all DBMS/database components. Audit records should contain (at a minimum): -Time stamps to establish when the events occurred -Sufficient information to establish what type of events occurred -Sufficient information to establish where the events occurred -Sufficient information to establish the sources (origins) of the events -Sufficient information to establish the outcome (success or failure) of the events -Sufficient information to establish the identity of any user/subject or process associated with the event Audit record content which may be necessary to investigate the events relating to an incident or identify those responsible for one. Audit policy includes, for example, time stamps, user/process identifiers, event descriptions, success/fail indications, filenames involved, and access control or flow control rules invoked. In order to compile an accurate risk assessment and provide forensic analysis, it is essential for security personnel to know where events occurred, such as application components, modules, session identifiers, filenames, host names, and functionality. The list of minimum DoD-defined audit events includes: -When privileges/permissions are retrieved, added, modified or deleted -When unsuccessful attempts to retrieve, add, modify, delete privileges/permissions occur -Enforcement of access restrictions associated with changes to the configuration of the database(s) -When security objects are accessed, modified, or deleted -When unsuccessful attempts to access, modify, or delete security objects occur -When categories of information (e.g., classification levels/security levels) are accessed, created, modified, or deleted -When unsuccessful attempts to access, create, modify, or delete categorized information occur -All privileged activities or other system-level access -When unsuccessful attempts to execute privileged activities or other system-level access occur -When successful or unsuccessful access to objects occur For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems. Satisfies: SRG-APP-000095-DB-000039, SRG-APP-000091-DB-000325, SRG-APP-000096-DB-000040, SRG-APP-000097-DB-000041, SRG-APP-000098-DB-000042, SRG-APP-000099-DB-000043, SRG-APP-000100-DB-000201, SRG-APP-000381-DB-000361, SRG-APP-000492-DB-000332, SRG-APP-000492-DB-000333, SRG-APP-000494-DB-000344, SRG-APP-000494-DB-000345, SRG-APP-000495-DB-000326, SRG-APP-000495-DB-000327, SRG-APP-000495-DB-000328, SRG-APP-000495-DB-000329, SRG-APP-000496-DB-000334, SRG-APP-000496-DB-000335, SRG-APP-000498-DB-000346, SRG-APP-000498-DB-000347, SRG-APP-000499-DB-000330, SRG-APP-000499-DB-000331, SRG-APP-000501-DB-000336, SRG-APP-000501-DB-000337, SRG-APP-000502-DB-000348, SRG-APP-000502-DB-000349, SRG-APP-000504-DB-000354, SRG-APP-000504-DB-000355, SRG-APP-000507-DB-000356, SRG-APP-000507-DB-000357</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>