Skip to content
ATO Pathways
  Log In

I - Mission Critical Classified

Rules and Groups employed by this XCCDF Profile

  • SRG-APP-000133-DB-000362

    <GroupDescription></GroupDescription>
    Group
    Show

  • CA IDMS must secure the ability to create, alter, drop, grant, and revoke user and/or system profiles to users or groups.

    &lt;VulnDiscussion&gt;Even when using an external security manager (ESM), IDMS system and user profiles which reside in an IDMS user catalog may be...
    Rule Medium Severity
    Show

  • SRG-APP-000141-DB-000090

    <GroupDescription></GroupDescription>
    Group
    Show

  • The EMPDEMO databases, database objects, and applications must be removed.

    &lt;VulnDiscussion&gt;Demonstration and sample database objects and applications present publicly known attack points for malicious users. These de...
    Rule Low Severity
    Show

  • SRG-APP-000141-DB-000091

    <GroupDescription></GroupDescription>
    Group
    Show

  • Default demonstration and sample databases, database objects, and applications must be removed.

    &lt;VulnDiscussion&gt;Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, pr...
    Rule Low Severity
    Show

  • SRG-APP-000141-DB-000092

    <GroupDescription></GroupDescription>
    Group
    Show

  • IDMS components that cannot be uninstalled must be disabled.

    &lt;VulnDiscussion&gt;DBMSs must adhere to the principles of least functionality by providing only essential capabilities. At installation, all CA ...
    Rule Low Severity
    Show

  • SRG-APP-000142-DB-000094

    <GroupDescription></GroupDescription>
    Group
    Show

  • IDMS nodes, lines, and pterms must be protected from unauthorized use.

    &lt;VulnDiscussion&gt;In order to prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e....
    Rule Medium Severity
    Show

  • SRG-APP-000148-DB-000103

    <GroupDescription></GroupDescription>
    Group
    Show

  • The IDMS environment must require sign-on for users and restrict them to only authorized functions.

    &lt;VulnDiscussion&gt;To ensure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to pre...
    Rule Medium Severity
    Show

  • SRG-APP-000164-DB-000401

    <GroupDescription></GroupDescription>
    Group
    Show

  • DBMS authentication using passwords must be avoided.

    &lt;VulnDiscussion&gt;Passwords that are easy to guess open a vulnerability allowing an unauthorized user to potentially gain access to the DBMS. I...
    Rule Medium Severity
    Show

  • SRG-APP-000172-DB-000075

    <GroupDescription></GroupDescription>
    Group
    Show

  • Passwords sent through ODBC/JDBC must be encrypted.

    &lt;VulnDiscussion&gt;Unencrypted passwords transmitted from ODBC and JDBC may be intercepted to prevent their being intercepted in a plain-text fo...
    Rule Low Severity
    Show

  • SRG-APP-000180-DB-000115

    <GroupDescription></GroupDescription>
    Group
    Show

  • The DBMS must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).

    &lt;VulnDiscussion&gt;Non-organizational users include all information system users other than organizational users, which include organizational e...
    Rule Medium Severity
    Show

  • SRG-APP-000225-DB-000153

    <GroupDescription></GroupDescription>
    Group
    Show

  • IDMS executing in a local mode batch environment must be able to manually recover or restore database areas affected by failed transactions.

    &lt;VulnDiscussion&gt;Local mode update jobs can either use local mode journaling or perform a backup of the database prior to executing the local ...
    Rule Low Severity
    Show

  • SRG-APP-000233-DB-000124

    <GroupDescription></GroupDescription>
    Group
    Show

  • CA IDMS must isolate the security manager to which users, groups, roles are assigned authorities/permissions to resources.

    &lt;VulnDiscussion&gt;An isolation boundary provides access control and protects the integrity of the hardware, software, and firmware that perform...
    Rule Medium Severity
    Show

  • SRG-APP-000243-DB-000373

    <GroupDescription></GroupDescription>
    Group
    Show

  • IDMS must prevent unauthorized and unintended information transfer via database buffers.

    &lt;VulnDiscussion&gt;The purpose of this control is to prevent information, including encrypted representations of information, produced by the ac...
    Rule Medium Severity
    Show

  • SRG-APP-000251-DB-000160

    <GroupDescription></GroupDescription>
    Group
    Show

  • IDMS must check the validity of all data input unless the organization says otherwise.

    &lt;VulnDiscussion&gt;Invalid user input occurs when a user inserts data or characters into an application's data entry fields and the application ...
    Rule Medium Severity
    Show

  • SRG-APP-000251-DB-000391

    <GroupDescription></GroupDescription>
    Group
    Show

  • CA IDMS must permit the use of dynamic code execution only in circumstances determined by the organization and limit use of online and batch command facilities from which dynamic statements can be issued.

    &lt;VulnDiscussion&gt;The IDMS Common Facilities (BCF and OCF) can execute commands that can make updates to IDMS, and their use should be protecte...
    Rule Medium Severity
    Show

  • SRG-APP-000251-DB-000391

    <GroupDescription></GroupDescription>
    Group
    Show

  • CA IDMS must limit the use of dynamic statements in applications, procedures, and exits to circumstances determined by the organization.

    &lt;VulnDiscussion&gt;Dynamic SQL statements are compiled at runtime and, if manipulated by an unauthorized user, can produce an innumerable array ...
    Rule Medium Severity
    Show

  • SRG-APP-000251-DB-000391

    <GroupDescription></GroupDescription>
    Group
    Show

  • CA IDMS must limit use of IDMS server used in issuing dynamic statements from client applications circumstances determined by the organization.

    &lt;VulnDiscussion&gt;Server tasks can execute dynamic SQL code and should be protected.&lt;/VulnDiscussion&gt;&lt;FalsePositives&gt;&lt;/FalsePosi...
    Rule Medium Severity
    Show

  • SRG-APP-000251-DB-000392

    <GroupDescription></GroupDescription>
    Group
    Show

  • CA IDMS and associated applications, when making use of dynamic code execution, must scan input data for invalid values that may indicate a code injection attack.

    &lt;VulnDiscussion&gt;When the use of dynamic SQL is necessary, the code should be written so that the invalid data can be found and the appropriat...
    Rule Medium Severity
    Show

  • SRG-APP-000266-DB-000162

    <GroupDescription></GroupDescription>
    Group
    Show

  • IDMS must suppress security-related messages so that no information is returned that can be exploited.

    &lt;VulnDiscussion&gt;Error messages issued to non-privileged users may have contents that should be considered confidential. IDMS should be config...
    Rule Medium Severity
    Show

  • SRG-APP-000266-DB-000162

    <GroupDescription></GroupDescription>
    Group
    Show

  • Custom database code and associated application code must not contain information beyond what is needed for troubleshooting.

    &lt;VulnDiscussion&gt;Error codes issued by custom code could provide more information than needed for problem resolution and should be vetted to m...
    Rule Medium Severity
    Show

  • SRG-APP-000267-DB-000163

    <GroupDescription></GroupDescription>
    Group
    Show

  • IDMS must reveal security-related messages only to authorized users.

    &lt;VulnDiscussion&gt;Error messages issued to non-privileged users may have contents that should be considered confidential. IDMS should be config...
    Rule Medium Severity
    Show

  • SRG-APP-000267-DB-000163

    <GroupDescription></GroupDescription>
    Group
    Show

  • Custom database code and associated application code must reveal detailed error messages only to the Information System Security Officer (ISSO), Information System Security manager (ISSM), Systems Administrator (SA), and Database Administrator (DBA).

    &lt;VulnDiscussion&gt;Detailed error messages issued by custom or user-written code can possibly give too much detail to the users. This code shoul...
    Rule Medium Severity
    Show

  • SRG-APP-000295-DB-000305

    <GroupDescription></GroupDescription>
    Group
    Show

  • CA IDMS must automatically terminate a terminal session after organization-defined conditions or trigger events of terminal inactivity time.

    &lt;VulnDiscussion&gt;A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user...
    Rule Medium Severity
    Show

  • SRG-APP-000295-DB-000305

    <GroupDescription></GroupDescription>
    Group
    Show

  • CA IDMS must automatically terminate a batch external request unit after organization-defined conditions or trigger events after the batch program abnormally terminates.

    &lt;VulnDiscussion&gt;A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user...
    Rule Medium Severity
    Show

  • SRG-APP-000295-DB-000305

    <GroupDescription></GroupDescription>
    Group
    Show

  • CA IDMS must automatically terminate an external run-unit after organization-defined conditions or trigger events of time waiting to issue a database request.

    &lt;VulnDiscussion&gt;Inactive sessions, such as a logged on user who leaves their terminal, may give a bad actor access to the system.&lt;/VulnDis...
    Rule Medium Severity
    Show

  • SRG-APP-000295-DB-000305

    <GroupDescription></GroupDescription>
    Group
    Show

  • CA IDMS must automatically terminate a task or session after organization-defined conditions or trigger events of time waiting to get a resource and/or time of inactivity.

    &lt;VulnDiscussion&gt;A logical session (for local, network, and remote access) is initiated whenever a user (or process acting on behalf of a user...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules