STIGQter: STIG Summary: Oracle Database 11g Instance STIG Version: 8 Release: 20 Benchmark Date: 28 Jul 2017:

Case sensitivity for passwords should be enabled.

DISA Rule

SV-60351r1_rule

Vulnerability Number

V-16033

Group Title

Oracle SEC_CASE_SENSITIVE_LOGON parameter

Rule Version

DO6748-ORACLE11

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Enable case sensitive passwords.

From SQL*Plus:

alter system set sec_case_sensitive_logon = TRUE scope = both;

The above SQL*Plus command will set the parameter to take effect immediately and permanently at next system startup.

NOTE: Password and account requirements have changed for DoD since the STIG requirement listed in the table for this check was published.

Check Contents

From SQL*Plus:

select value from v$parameter where name = 'sec_case_sensitive_logon';

If the value returned is not TRUE, this is a Finding.

Vulnerability Number

V-16033

Documentable

False

Rule Version

DO6748-ORACLE11

Severity Override Guidance

From SQL*Plus:

select value from v$parameter where name = 'sec_case_sensitive_logon';

If the value returned is not TRUE, this is a Finding.

Check Content Reference

M

Responsibility

Database Administrator

Target Key

1367

Comments