Rotate your device back to portrait to use STIG Vault.

Home
Dashboard
Search
STIG Repository
STIG Compare
SCAP Repository
SCAP Compare
CCIs
Guides
Contact

Appearance

Palette

Oracle Database 11g Instance STIG

The Oracle Database 11g Instance STIG (V9 R1) has 94 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

94STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V9 · R1

CurrentPublished Wed Oct 27 2021

Unauthorized user accounts should not exist.

Oracle Database 11g Instance STIG

Assessment Title

Rule Text

Description

Discussion Text

Unauthorized user accounts provide unauthorized access to the database and may allow access to database objects. Only authorized users should be granted database accounts.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-2508

Rule

SV-24647r1_rule

Severity

medium

Rule Version

DG0070-ORACLE11

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Review procedures for ensuring authorization of new or re-assigned DBMS user accounts.

Requests for user account access to the DBMS should include documented approval by an authorized requestor.

Procedures should also include notification for a change in status, particularly cause for revocation of account access, to any DBMS accounts.
  
Review the user accounts listed either in the script report or manually against the authorized user list.

From SQL*Plus:
  select username from dba_users order by username;

If procedures for DBMS user account authorization are incomplete or not implemented, this is a Finding.

If any accounts listed are not clearly authorized, this is a Finding.

Implementation Procedure

Fix Text

Develop, document and implement procedures for authorizing creation, changes and deletions of user accounts.

Monitor user accounts to verify that they remain authorized.

STIG check 46 of 94 in the Oracle Database 11g Instance STIG checklist

← Previous · V-2507Audit trail data should be retained for one year.Next · V-2511 →Access to the Oracle SYS and SYSTEM accounts should be restricted to authorized DBAs.