STIGQter: STIG Summary: Database Security Requirements Guide Version: 3 Release: 1 Benchmark Date: 22 Jan 2021:

The DBMS must protect against a user falsely repudiating having performed organization-defined actions.

DISA Rule

SV-206522r617447_rule

Vulnerability Number

V-206522

Group Title

SRG-APP-000080

Rule Version

SRG-APP-000080-DB-000063

Severity

CAT II

CCI(s)

• CCI-000166 - The information system protects against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.

Weight

10

Fix Recommendation

Use accounts assigned to individual users. Where the application connects to the DBMS using a standard, shared account, ensure that it also captures the individual user identification and passes it to the DBMS.

Modify application database tables and all supporting code to capture the necessary audit data.

Modify the configuration of audit logs to include details identifying the individual user.

Check Contents

Review system documentation to determine the data and the actions on data that need to be protected from repudiation by means of audit trails.

Review DBMS settings to determine whether users can be identified as individuals when using shared accounts. If the individual user who is using a shared account cannot be identified, this is a finding.

Review the design and the contents of the application data tables. If they do not include the necessary audit data, this is a finding.

Review the configuration of audit logs to determine whether auditing includes details identifying the individual user. If it does not, this is a finding.

Vulnerability Number

V-206522

Documentable

False

Rule Version

SRG-APP-000080-DB-000063

Severity Override Guidance

Review system documentation to determine the data and the actions on data that need to be protected from repudiation by means of audit trails.

Review DBMS settings to determine whether users can be identified as individuals when using shared accounts. If the individual user who is using a shared account cannot be identified, this is a finding.

Review the design and the contents of the application data tables. If they do not include the necessary audit data, this is a finding.

Review the configuration of audit logs to determine whether auditing includes details identifying the individual user. If it does not, this is a finding.

Check Content Reference

M

Target Key

2902

Comments