I - Mission Critical Classified
Rules and Groups employed by this XCCDF Profile
-
SRG-APP-000141-DB-000092
Group -
Unused database components which are integrated in the MySQL Database Server 8.0 and cannot be uninstalled must be disabled.
Information systems are capable of providing a wide variety of functions and services. Some of the functions and services, provided by default, may not be necessary to support essential organizatio...Rule Medium Severity -
SRG-APP-000142-DB-000094
Group -
The MySQL Database Server 8.0 must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
To prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable or restr...Rule Medium Severity -
SRG-APP-000148-DB-000103
Group -
The MySQL Database Server 8.0 must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
To ensure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. Organizational use...Rule Medium Severity -
SRG-APP-000179-DB-000114
Group -
The MySQL Database Server 8.0 must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for cryptographic operations.
Use of weak or not validated cryptographic algorithms undermines the purposes of utilizing encryption and digital signatures to protect data. Weak algorithms can be easily broken and not validated ...Rule High Severity -
SRG-APP-000180-DB-000115
Group -
The MySQL Database Server 8.0 must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).
Non-organizational users include all information system users other than organizational users, which include organizational employees or individuals the organization deems to have equivalent status...Rule Medium Severity -
SRG-APP-000211-DB-000122
Group -
The MySQL Database Server 8.0 must separate user functionality (including user interface services) from database management functionality.
Information system management functionality includes functions necessary to administer databases, network components, workstations, or servers, and typically requires privileged user access. The ...Rule Medium Severity -
SRG-APP-000233-DB-000124
Group -
The MySQL Database Server 8.0 must isolate security functions from non-security functions.
An isolation boundary provides access control and protects the integrity of the hardware, software, and firmware that perform security functions. Security functions are the hardware, software, an...Rule Medium Severity -
SRG-APP-000243-DB-000128
Group -
Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.
Applications, including DBMSs, must prevent unauthorized and unintended information transfer via shared system resources. Data used for the development and testing of applications often involves ...Rule Medium Severity -
SRG-APP-000243-DB-000374
Group -
Access to database files must be limited to relevant processes and to authorized, administrative users.
Applications, including DBMSs, must prevent unauthorized and unintended information transfer via shared system resources. Permitting only DBMS processes and authorized, administrative users to have...Rule Medium Severity -
SRG-APP-000224-DB-000384
Group -
The MySQL Database Server 8.0 must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.
One class of man-in-the-middle, or session hijacking, attack involves the adversary guessing at valid session identifiers based on patterns in identifiers already known. The preferred technique fo...Rule Medium Severity -
SRG-APP-000231-DB-000154
Group -
The MySQL Database Server 8.0 must protect the confidentiality and integrity of all information at rest.
This control is intended to address the confidentiality and integrity of information at rest in non-mobile devices and covers user information and system information. Information at rest refers to ...Rule High Severity -
SRG-APP-000251-DB-000160
Group -
The MySQL Database Server 8.0 must check the validity of all data inputs except those specifically identified by the organization.
Invalid user input occurs when a user inserts data or characters into an application's data entry fields and the application is unprepared to process that data. This results in unanticipated applic...Rule Medium Severity -
SRG-APP-000251-DB-000391
Group -
The MySQL Database Server 8.0 and associated applications must reserve the use of dynamic code execution for situations that require it.
With respect to database management systems, one class of threat is known as SQL Injection, or more generally, code injection. It takes advantage of the dynamic execution capabilities of various pr...Rule Medium Severity -
SRG-APP-000251-DB-000392
Group -
The MySQL Database Server 8.0 and associated applications, when making use of dynamic code execution, must scan input data for invalid values that may indicate a code injection attack.
With respect to database management systems, one class of threat is known as SQL Injection, or more generally, code injection. It takes advantage of the dynamic execution capabilities of various pr...Rule Medium Severity -
SRG-APP-000092-DB-000208
Group -
The MySQL Database Server 8.0 must initiate session auditing upon startup.
Session auditing is for use when a user's activities are under investigation. To be sure of capturing all activity during those periods when session auditing is in use, it needs to be in operation ...Rule Medium Severity -
SRG-APP-000121-DB-000202
Group -
The MySQL Database Server 8.0 must protect its audit features from unauthorized access.
Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Depending upon the log format and application, system and application log tools may ...Rule Medium Severity -
SRG-APP-000122-DB-000203
Group -
The MySQL Database Server 8.0 must protect its audit configuration from unauthorized modification.
Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on au...Rule Medium Severity -
SRG-APP-000123-DB-000204
Group -
The MySQL Database Server 8.0 must protect its audit features from unauthorized removal.
Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on au...Rule Medium Severity -
SRG-APP-000133-DB-000179
Group -
The MySQL Database Server 8.0 must limit privileges to change software modules, to include stored procedures, functions and triggers, and links to software external to the MySQL Database Server 8.0.
If the system were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robus...Rule Medium Severity -
SRG-APP-000133-DB-000198
Group -
The MySQL Database Server 8.0 software installation account must be restricted to authorized users.
When dealing with change control issues, it must be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can have significant effects...Rule Medium Severity -
SRG-APP-000133-DB-000199
Group -
Database software, including MySQL Database Server 8.0 configuration files, must be stored in dedicated directories, or DASD pools (remove), separate from the host OS and other applications.
When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have signi...Rule Medium Severity -
SRG-APP-000133-DB-000362
Group -
The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the MySQL Database Server 8.0, etc.) must be restricted to authorized users.
If the DBMS were to allow any user to make changes to database structure or logic, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of ...Rule Medium Severity -
SRG-APP-000383-DB-000364
Group -
The MySQL Database Server 8.0 must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.
Use of nonsecure network functions, ports, protocols, and services exposes the system to avoidable threats.Rule Medium Severity -
SRG-APP-000378-DB-000365
Group -
The MySQL Database Server 8.0 must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status.
Allowing regular users to install software, without explicit privileges, creates the risk that untested or potentially malicious software will be installed on the system. Explicit privileges (escal...Rule Medium Severity -
SRG-APP-000380-DB-000360
Group -
The MySQL Database Server 8.0 must enforce access restrictions associated with changes to the configuration of the MySQL Database Server 8.0 or database(s).
Failure to provide logical access restrictions associated with changes to configuration may have significant effects on the overall security of the system. When dealing with access restrictions p...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.