II - Mission Support Classified
Rules and Groups employed by this XCCDF Profile
-
SRG-APP-000498-DB-000347
Group -
PostgreSQL must generate audit records when unsuccessful attempts to modify categorized information (e.g., classification levels/security levels) occur.
Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. To aid in diagnosis, it is necessary to keep track of failed ...Rule Medium Severity -
SRG-APP-000507-DB-000357
Group -
PostgreSQL must generate audit records when unsuccessful accesses to objects occur.
Without tracking all or selected types of access to all or selected objects (tables, views, procedures, functions, etc.), it would be difficult to establish, correlate, and investigate the events r...Rule Medium Severity -
SRG-APP-000504-DB-000354
Group -
PostgreSQL must generate audit records for all privileged activities or other system-level access.
Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. System documentation...Rule Medium Severity -
SRG-APP-000494-DB-000345
Group -
PostgreSQL must generate audit records when unsuccessful attempts to access categorized information (e.g., classification levels/security levels) occur.
Changes in categories of information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. To aid in diagnosis, it is necessary to keep track of faile...Rule Medium Severity -
SRG-APP-000492-DB-000332
Group -
PostgreSQL must be able to generate audit records when security objects are accessed.
Changes to the security configuration must be tracked. This requirement applies to situations where security data is retrieved or modified via data manipulation operations, as opposed to via speci...Rule Medium Severity -
SRG-APP-000499-DB-000330
Group -
PostgreSQL must generate audit records when privileges/permissions are deleted.
Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevat...Rule Medium Severity -
SRG-APP-000506-DB-000353
Group -
PostgreSQL must generate audit records when concurrent logons/connections by the same user from different workstations occur.
For completeness of forensic analysis, it is necessary to track who logs on to PostgreSQL. Concurrent connections by the same user from multiple workstations may be valid use of the system; or suc...Rule Medium Severity -
SRG-APP-000501-DB-000337
Group -
PostgreSQL must generate audit records when unsuccessful attempts to delete security objects occur.
The removal of security objects from the database/PostgreSQL would seriously degrade a system's information assurance posture. If such an action is attempted, it must be logged. To aid in diagnosi...Rule Medium Severity -
SRG-APP-000495-DB-000328
Group -
PostgreSQL must generate audit records when privileges/permissions are modified.
Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevat...Rule Medium Severity -
SRG-APP-000504-DB-000355
Group -
PostgreSQL must generate audit records when unsuccessful attempts to execute privileged activities or other system-level access occur.
Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. System documentation ...Rule Medium Severity -
SRG-APP-000496-DB-000334
Group -
PostgreSQL must generate audit records when security objects are modified.
Changes in the database objects (tables, views, procedures, functions) that record and control permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail,...Rule Medium Severity -
SRG-APP-000498-DB-000346
Group -
PostgreSQL must generate audit records when categories of information (e.g., classification levels/security levels) is modified.
Changes in categories of information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected. For detailed information on categorizing information, refer...Rule Medium Severity -
SRG-APP-000495-DB-000329
Group -
PostgreSQL must generate audit records when unsuccessful attempts to modify privileges/permissions occur.
Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go...Rule Medium Severity -
SRG-APP-000495-DB-000327
Group -
PostgreSQL must generate audit records when unsuccessful attempts to add privileges/permissions occur.
Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could go...Rule Medium Severity -
SRG-APP-000175-DB-000067
Group -
PostgreSQL, when utilizing PKI-based authentication, must validate certificates by performing RFC 5280-compliant certification path validation.
The DoD standard for authentication is DoD-approved PKI certificates. A certificate's certification path is the path from the end entity certificate to a trusted root certification authority (CA)....Rule Medium Severity -
SRG-APP-000097-DB-000041
Group -
PostgreSQL must produce audit records containing sufficient information to establish where the events occurred.
Information system auditing capability is critical for accurate forensic analysis. Without establishing where events occurred, it is impossible to establish, correlate, and investigate the events r...Rule Medium Severity -
SRG-APP-000441-DB-000378
Group -
PostgreSQL must maintain the confidentiality and integrity of information during preparation for transmission.
Information can be either unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, an...Rule Medium Severity -
SRG-APP-000089-DB-000064
Group -
PostgreSQL must be configured to provide audit record generation for DoD-defined auditable events within all DBMS/database components.
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. Audit re...Rule Medium Severity -
SRG-APP-000375-DB-000323
Group -
PostgreSQL must generate time stamps, for audit records and application data, with a minimum granularity of one second.
Without sufficient granularity of time stamps, it is not possible to adequately determine the chronological order of records. Time stamps generated by PostgreSQL must include date and time. Granu...Rule Medium Severity -
SRG-APP-000100-DB-000201
Group -
PostgreSQL must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event.
Information system auditing capability is critical for accurate forensic analysis. Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of us...Rule Medium Severity -
SRG-APP-000514-DB-000382
Group -
PostgreSQL must implement NIST FIPS 140-2 or 140-3 validated cryptographic modules to generate and validate cryptographic hashes.
Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards ...Rule High Severity -
SRG-APP-000416-DB-000380
Group -
PostgreSQL must use NSA-approved cryptography to protect classified information in accordance with the data owner’s requirements.
Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards ...Rule High Severity -
SRG-APP-000514-DB-000383
Group -
PostgreSQL must implement NIST FIPS 140-2 or 140-3 validated cryptographic modules to protect unclassified information requiring confidentiality and cryptographic protection, in accordance with the data owner’s requirements.
Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards ...Rule High Severity -
SRG-APP-000231-DB-000154
Group -
PostgreSQL must protect the confidentiality and integrity of all information at rest.
This control is intended to address the confidentiality and integrity of information at rest in non-mobile devices and covers user information and system information. Information at rest refers to ...Rule High Severity -
SRG-APP-000378-DB-000365
Group -
PostgreSQL must prohibit user installation of logic modules (functions, trigger procedures, views, etc.) without explicit privileged status.
Allowing regular users to install software, without explicit privileges, creates the risk that untested or potentially malicious software will be installed on the system. Explicit privileges (escal...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.