Oracle Database 11.2g Security Technical Implementation Guide

The Oracle Database 11.2g Security Technical Implementation Guide (V1 R19) has 203 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

203STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R19

CurrentPublished Fri Jul 24 2020

The IAM must review changes to DBA role assignments.

Oracle Database 11.2g Security Technical Implementation Guide

Assessment Title

Rule Text

The IAM must review changes to DBA role assignments.

Description

Discussion Text

Unauthorized assignment of DBA privileges can lead to a compromise of DBMS integrity. Providing oversight to the authorization and assignment of privileges provides the separation of duty to support sufficient oversight.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-54027

Rule

SV-68267r1_rule

Severity

medium

Rule Version

O112-BP-024600

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Review policy and procedures documented or noted in the System Security Plan as well as evidence of implementation for monitoring changes to DBA role assignments and procedures for notifying the IAM of the changes for review.

If policy, procedures or implementation evidence do not exist, this is a Finding.

Implementation Procedure

Fix Text

Develop, document and implement procedures to monitor changes to DBA role assignments.

Develop, document and implement procedures to notify the IAM of changes to DBA role assignments.

Include in the procedures methods that provide evidence of monitoring and notification.

STIG check 181 of 203 in the Oracle Database 11.2g STIG checklist

← Previous · V-54025The database must not be directly accessible from public or unauthorized networks.Next · V-54029 →Plans and procedures for testing DBMS installations, upgrades and patches must be defined and followed prior to production implementation.