The MySQL Database Server 8.0 must generate audit records when categories of information (e.g., classification levels/security levels) are modified.

An XCCDF Rule

Description

<VulnDiscussion>Changes in categories of information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. For detailed information on categorizing information, refer to FIPS Publication 199, Standards for Security Categorization of Federal Information and Information Systems, and FIPS Publication 200, Minimum Security Requirements for Federal Information and Information Systems.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>

ID: SV-235117r961809_rule
Severity: Medium
References: CCI-000172
Updated: 17 days ago

If currently required, configure the MySQL Database Server with update, insert, and delete triggers that call audit_api_message_emit_udf() function  to produce audit records when unsuccessful attempts to modify categories of information occur.

Add security level details in an additional column.

Add the component for adding information to the audit log.
INSTALL COMPONENT "file://component_audit_api_message_emit”;
create schema test_trigger;

Create a stored procedure to allow the audit_api_message_emit_udf to be called as well as providing the details for the audit event.

DELIMITER $$

CREATE PROCEDURE audit_api_message_emit_delete_sp(name CHAR(20))
BEGIN
	DECLARE aud_msg VARCHAR(255);
	select audit_api_message_emit_udf('sec_level_trigger',
                                         'TRIGGER audit_change_attempt',
                                         'Attempt was made to change H level sec data',
                                         'FOR ', name
                                         ) into aud_msg;
END$$
DELIMITER ;

See the supplemental file "MySQL80Audit.sql".

The MySQL Database Server 8.0 must generate audit records when categories of information (e.g., classification levels/security levels) are modified.

Description

Remediation - Manual Procedure