STIGQter: STIG Summary: Oracle MySQL 8.0 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Jan 2021:

The MySQL Database Server 8.0 must associate organization-defined types of security labels having organization-defined security label values with information in process.

DISA Rule

SV-235183r638812_rule

Vulnerability Number

V-235183

Group Title

SRG-APP-000313-DB-000309

Rule Version

MYS8-00-010900

Severity

CAT II

CCI(s)

• CCI-002263 - The organization provides the means to associate organization-defined types of security attributes having organization-defined security attribute values with information in process.

Weight

10

Fix Recommendation

Deploy MySQL Views and Stored Procedures or a third-party software, or add custom data structures, data elements and application code, to provide reliable security labeling of information in storage.

Check Contents

If security labeling is not required, this is not a finding.

If security labeling requirements have been specified, check for a MySQL solution using views and Stored Procedures to implement a row-level security solution that reliably maintains labels on information in storage.

For data that have been labeled with a column indicating data is classified read-only, views can be created and secured via access privileges such that a user should only be able to view the data that have a specific tag or tags (e.g., user [x] can only view records that are labeled with the tag of classified).

If a MySQL solution through the use of views and stored procedures or a third party solution does not exist, this is a finding.

Vulnerability Number

V-235183

Documentable

False

Rule Version

MYS8-00-010900

Severity Override Guidance

If security labeling is not required, this is not a finding.

If security labeling requirements have been specified, check for a MySQL solution using views and Stored Procedures to implement a row-level security solution that reliably maintains labels on information in storage.

For data that have been labeled with a column indicating data is classified read-only, views can be created and secured via access privileges such that a user should only be able to view the data that have a specific tag or tags (e.g., user [x] can only view records that are labeled with the tag of classified).

If a MySQL solution through the use of views and stored procedures or a third party solution does not exist, this is a finding.

Check Content Reference

M

Target Key

5277

Comments