STIGQter: STIG Summary: Oracle Database 11g Installation STIG Version: 8 Release: 20 Benchmark Date: 28 Jul 2017:

Passwords should be encrypted when transmitted across the network.

DISA Rule

SV-24967r1_rule

Vulnerability Number

V-15636

Group Title

DBMS passwords in transit

Rule Version

DG0129-ORACLE11

Severity

CAT I

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Utilize Oracle connection protocols and products (i.e. Oracle Client) where possible.

Where other connection products and protocols are used, ensure configuration options for encrypting passwords during login events across the network are used.

If the database does not provide encryption for login events natively, employ encryption at the OS or network level.

Ensure passwords remain encrypted from source to destination.

Check Contents

Oracle natively encrypts passwords in transit when using Oracle connection protocols and products (i.e. Oracle Client).

Where other connection products and protocols are used, review configuration options for encrypting passwords during login events across the network.

If passwords are not encrypted, this is a Finding.

Where only Oracle connection protocols and products are used and password encryption is not purposely disabled and enabled where applicable, this is Not a Finding.

If determined that passwords are passed unencrypted at any point along the transmission path between the source and destination, this is a Finding.

Vulnerability Number

V-15636

Documentable

False

Rule Version

DG0129-ORACLE11

Severity Override Guidance

Oracle natively encrypts passwords in transit when using Oracle connection protocols and products (i.e. Oracle Client).

Where other connection products and protocols are used, review configuration options for encrypting passwords during login events across the network.

If passwords are not encrypted, this is a Finding.

Where only Oracle connection protocols and products are used and password encryption is not purposely disabled and enabled where applicable, this is Not a Finding.

If determined that passwords are passed unencrypted at any point along the transmission path between the source and destination, this is a Finding.

Check Content Reference

M

Responsibility

Database Administrator

Target Key

1368

Comments