The EDB Postgres Advanced Server must protect the confidentiality and integrity of all information at rest.
An XCCDF Rule
Description
<VulnDiscussion>This control is intended to address the confidentiality and integrity of information at rest in non-mobile devices and covers user information and system information. Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive) within an organizational information system. Applications and application users generate information throughout the course of their application use. User data generated, as well as application-specific configuration data, must be protected. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate. If the confidentiality and integrity of application data is not protected, the data will be open to compromise and unauthorized modification.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-224178r879642_rule
- Severity
- High
- References
- Updated
Remediation - Manual Procedure
Complete these steps as the Windows user that serves as the user who is configure to run the EDB Postgres database service. If done as a different user, the Windows database service user will be unable to view this folder and therefore unable to start the database. By default, the service is configured to be run by the NetworkService account, which is a special Windows account that may not have the ability to encrypt the data directory. As a result, it may be necessary to change the service to run under a different account that can access the directory and encrypt it.
Use the following steps, to update the service, encrypt the data directory, and restart the service:
1. Change the edb-as-11 service to run as a local user account that is the same domain user that will be used to encrypt the data directory (ex. "administrator").
Open Computer Management >> Services.
Highlight the "edb-as-11 service".