STIGQter STIGQter: STIG Summary: Database Security Requirements Guide Version: 3 Release: 1 Benchmark Date: 22 Jan 2021:

The DBMS must generate audit records for all privileged activities or other system-level access.

DISA Rule

SV-206632r617447_rule

Vulnerability Number

V-206632

Group Title

SRG-APP-000504

Rule Version

SRG-APP-000504-DB-000354

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Deploy a DBMS capable of producing the required audit records when privileged actions occur.

Configure the DBMS to produce audit records when privileged actions occur.

Check Contents

Review DBMS documentation to verify that authorized administrative users can designate actions as privileged and that audit records can be produced when privileged actions occur.

If the DBMS is not capable of this, this is a finding.

Review the system documentation to obtain the definition of the database/DBMS functionality considered privileged in the context of the system in question.

Review the DBMS/database security and audit configurations and/or other means used to implement audit logging.

If audit logging covers at least all of the actions defined as privileged, this is not a finding; otherwise, this is a finding.

Vulnerability Number

V-206632

Documentable

False

Rule Version

SRG-APP-000504-DB-000354

Severity Override Guidance

Review DBMS documentation to verify that authorized administrative users can designate actions as privileged and that audit records can be produced when privileged actions occur.

If the DBMS is not capable of this, this is a finding.

Review the system documentation to obtain the definition of the database/DBMS functionality considered privileged in the context of the system in question.

Review the DBMS/database security and audit configurations and/or other means used to implement audit logging.

If audit logging covers at least all of the actions defined as privileged, this is not a finding; otherwise, this is a finding.

Check Content Reference

M

Target Key

2902

Comments