The DBMS must support taking organization-defined list of least disruptive actions to terminate suspicious events.
An XCCDF Rule
Description
<VulnDiscussion>System availability is a key tenet of system security. Organizations need to have the flexibility to be able to define the automated actions taken in response to an identified incident. This includes being able to define a least disruptive action the application takes to terminate suspicious events. A least disruptive action may include initiating a request for human response rather than blocking traffic or disrupting system operation. In order to preserve availability, it is important for the DBMS to terminate suspicious events with the least disruptive action possible. If suspicious events are not terminated, an attacker may gain entry into the system; however, if the system overreacts to a suspicious event and takes an overly disruptive action, a Denial of Service (DoS) may occur.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-238479r879887_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
If the list does not exist, create it.
For any event type defined in the list where no means of detecting the event exists, either create the means of detection or modify the list.
For each event type where an automatic countermeasure is defined but its implementation differs from its description in the list, either modify the countermeasure or amend the list.