What changed in VMW vRealize Operations Manager 6.x PostgreSQL STIG V1R2V1R2 changes

VMW vRealize Operations Manager 6.x PostgreSQL STIG V1R2 (2023-10-25) replaced V1R1 (2018-09-28): 69 checks added, 69 removed. It has 69 checks, against 69 in V1R1.

V1R2 checklistV1R1 checklist Compare V1R1 and V1R2 in STIG Compare

  • 69 added
  • 69 removed
  • 0 updated

Added in V1R2 (69)

  • V-239772CAT IIThe vROps PostgreSQL DB must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.
  • V-239773CAT IIThe vROps PostgreSQL DB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.
  • V-239774CAT IIThe vROps PostgreSQL DB must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
  • V-239775CAT IIThe vROps PostgreSQL DB must be able to generate audit records when privileges/permissions are retrieved.
  • V-239776CAT IIThe vROps PostgreSQL DB must initiate session auditing upon startup.
  • V-239777CAT IIThe vROps PostgreSQL DB must produce audit records containing sufficient information to establish what type of events occurred.
  • V-239778CAT IIThe vROps PostgreSQL DB must produce audit records containing time stamps to establish when the events occurred.
  • V-239779CAT IIThe vROps PostgreSQL DB must produce audit records containing sufficient information to establish where the events occurred.
  • V-239780CAT IIThe vROps PostgreSQL DB must produce audit records containing sufficient information to establish the sources (origins) of the events.
  • V-239781CAT IIThe vROps PostgreSQL DB must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.
  • V-239782CAT IIThe vROps PostgreSQL DB must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event.
  • V-239783CAT IIThe vROps PostgreSQL DB must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.
  • V-239784CAT IIIThe vROps PostgreSQL DB must be configurable to overwrite audit log records, oldest first (First-In-First-Out - FIFO), in the event of unavailability of space for more audit log records.
  • V-239785CAT IIThe audit information produced by the vROps PostgreSQL DB must be protected from unauthorized read access.
  • V-239786CAT IIThe audit information produced by the vROps PostgreSQL DB must be protected from unauthorized modification.
  • V-239787CAT IIThe audit information produced by the vROps PostgreSQL DB must be protected from unauthorized deletion.
  • V-239788CAT IIThe vROps PostgreSQL DB must protect its audit features from unauthorized access.
  • V-239789CAT IIThe vROps PostgreSQL DB must protect its audit configuration from unauthorized modification.
  • V-239790CAT IIThe vROps PostgreSQL DB must protect its audit features from unauthorized removal.
  • V-239791CAT IIvROps PostgreSQL DB objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to the DBMS, etc.) must be owned by vROps PostgreSQL DB principals authorized for ownership.
  • V-239792CAT IIThe role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the vROps PostgreSQL DB, etc.) must be restricted to authorized users.
  • V-239793CAT IIDefault demonstration and sample databases, database objects, and applications must be removed.
  • V-239794CAT IIThe vROps PostgreSQL DB must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
  • V-239795CAT IIThe vROps PostgreSQL DB must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
  • V-239796CAT IIIf passwords are used for authentication, the vROps PostgreSQL DB must store only hashed, salted representations of passwords.
  • V-239797CAT IIIf passwords are used for authentication, the vROps PostgreSQL DB must transmit only encrypted representations of passwords.
  • V-239798CAT IThe vROps PostgreSQL DB must use NIST FIPS 140-2 validated cryptographic modules for cryptographic operations.
  • V-239799CAT IIIn the event of a system failure, the vROps PostgreSQL DB must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes.
  • V-239800CAT IIThe vROps PostgreSQL DB must isolate security functions from non-security functions.
  • V-239801CAT IIvROps PostgreSQL DB contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.
  • V-239802CAT IIThe vROps PostgreSQL DB must reveal detailed error messages only to the ISSO, ISSM, SA and DBA.
  • V-239803CAT IIThe vROps PostgreSQL DB must utilize centralized management of the content captured in audit records generated by all components of the DBMS.
  • V-239804CAT IIThe vROps PostgreSQL DB must provide centralized configuration of the content to be captured in audit records generated by all components of the DBMS.
  • V-239805CAT IIThe vROps PostgreSQL DB must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75% of maximum audit record storage capacity.
  • V-239806CAT IIThe vROps PostgreSQL DB must provide an immediate real-time alert to appropriate support staff of all audit failure events requiring real-time alerts.
  • V-239807CAT IIThe vROps PostgreSQL DB must record time stamps, in audit records and application data that can be mapped to Coordinated Universal Time (UTC, formerly GMT).
  • V-239808CAT IIThe vROps PostgreSQL DB must generate time stamps, for audit records and application data, with a minimum granularity of one second.
  • V-239809CAT IIThe vROps PostgreSQL DB must enforce access restrictions associated with changes to the configuration of the DBMS or database(s).
  • V-239810CAT IIThe vROps PostgreSQL DB must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.
  • V-239811CAT IIWhen invalid inputs are received, the vROps PostgreSQL DB must behave in a predictable and documented manner that reflects organizational and system objectives.
  • V-239812CAT ISecurity-relevant software updates to the vROps PostgreSQL DB must be installed within the time period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, and STIGs).
  • V-239813CAT IIThe vROps PostgreSQL DB must be able to generate audit records when security objects are accessed.
  • V-239814CAT IIThe vROps PostgreSQL DB must generate audit records when unsuccessful attempts to access security objects occur.
  • V-239815CAT IIThe vROps PostgreSQL DB must generate audit records when privileges/permissions are added.
  • V-239816CAT IIThe vROps PostgreSQL DB must generate audit records when unsuccessful attempts to add privileges/permissions occur.
  • V-239817CAT IIThe vROps PostgreSQL DB must generate audit records when privileges/permissions are modified.
  • V-239818CAT IIThe vROps PostgreSQL DB must generate audit records when unsuccessful attempts to modify privileges/permissions occur.
  • V-239819CAT IIThe vROps PostgreSQL DB must generate audit records when security objects are modified.
  • V-239820CAT IIThe vROps PostgreSQL DB must generate audit records when unsuccessful attempts to modify security objects occur.
  • V-239821CAT IIThe vROps PostgreSQL DB must generate audit records when privileges/permissions are deleted.
  • V-239822CAT IIThe vROps PostgreSQL DB must generate audit records when unsuccessful attempts to delete privileges/permissions occur.
  • V-239823CAT IIThe vROps PostgreSQL DB must generate audit records when security objects are deleted.
  • V-239824CAT IIThe vROps PostgreSQL DB must generate audit records when unsuccessful attempts to delete security objects occur.
  • V-239825CAT IIThe vROps PostgreSQL DB must generate audit records when categories of information (e.g., classification levels/security levels) are deleted.
  • V-239826CAT IIThe vROps PostgreSQL DB must generate audit records when successful logons or connections occur.
  • V-239827CAT IIThe vROps PostgreSQL DB must generate audit records when unsuccessful logons or connection attempts occur.
  • V-239828CAT IIThe vROps PostgreSQL DB must generate audit records for all privileged activities or other system-level access.
  • V-239829CAT IIThe vROps PostgreSQL DB must generate audit records when unsuccessful attempts to execute privileged activities or other system-level access occur.
  • V-239830CAT IIThe vROps PostgreSQL DB must generate audit records showing starting and ending time for user access to the database(s).
  • V-239831CAT IIThe vROps PostgreSQL DB must generate audit records when concurrent logons/connections by the same user from different workstations occur.
  • V-239832CAT IIThe vROps PostgreSQL DB must be able to generate audit records when successful accesses to objects occur.
  • V-239833CAT IIThe vROps PostgreSQL DB must generate audit records when unsuccessful accesses to objects occur.
  • V-239834CAT IIThe vROps PostgreSQL DB must generate audit records for all direct access to the database(s).
  • V-239835CAT IThe vROps PostgreSQL DB must implement NIST FIPS 140-2 validated cryptographic modules to provision digital signatures.
  • V-239836CAT IThe vROps PostgreSQL DB must implement NIST FIPS 140-2 validated cryptographic modules to generate and validate cryptographic hashes.
  • V-239837CAT IThe vROps PostgreSQL DB must implement NIST FIPS 140-2 validated cryptographic modules to protect unclassified information requiring confidentiality and cryptographic protection, in accordance with the data owners requirements.
  • V-239838CAT IIThe vROps PostgreSQL DB must off-load audit data to a separate log management facility; this must be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for stand-alone systems.
  • V-239839CAT IIThe vROps PostgreSQL DB must be configured in accordance with the security configuration settings based on DoD security configuration and implementation guidance, including STIGs, NSA configuration guides, CTOs, DTMs, and IAVMs.
  • V-258458CAT IThe version of vRealize Operations Manager 6.x PostgreSQL running on the system must be a supported version.

Removed since V1R1 (69)

  • V-88215CAT IIThe vROps PostgreSQL DB must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.
  • V-88217CAT IIThe vROps PostgreSQL DB must provide audit record generation for DoD-defined auditable events within all DBMS/database components.
  • V-88219CAT IIThe vROps PostgreSQL DB must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.
  • V-88221CAT IIThe vROps PostgreSQL DB must be able to generate audit records when privileges/permissions are retrieved.
  • V-88223CAT IIThe vROps PostgreSQL DB must initiate session auditing upon startup.
  • V-88225CAT IIThe vROps PostgreSQL DB must provide authorized users to capture, record, and log all content related to a user session.
  • V-88227CAT IIThe vROps PostgreSQL DB must produce audit records containing sufficient information to establish what type of events occurred.
  • V-88229CAT IIThe vROps PostgreSQL DB must produce audit records containing time stamps to establish when the events occurred.
  • V-88231CAT IIThe vROps PostgreSQL DB must produce audit records containing sufficient information to establish where the events occurred.
  • V-88233CAT IIThe vROps PostgreSQL DB must produce audit records containing sufficient information to establish the sources (origins) of the events.
  • V-88235CAT IIThe vROps PostgreSQL DB must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.
  • V-88237CAT IIThe vROps PostgreSQL DB must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event.
  • V-88239CAT IIThe vROps PostgreSQL DB must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.
  • V-88241CAT IIIThe vROps PostgreSQL DB must be configurable to overwrite audit log records, oldest first (First-In-First-Out - FIFO), in the event of unavailability of space for more audit log records.
  • V-88243CAT IIThe audit information produced by the vROps PostgreSQL DB must be protected from unauthorized read access.
  • V-88245CAT IIThe audit information produced by the vROps PostgreSQL DB must be protected from unauthorized modification.
  • V-88247CAT IIThe audit information produced by the vROps PostgreSQL DB must be protected from unauthorized deletion.
  • V-88249CAT IIThe vROps PostgreSQL DB must protect its audit features from unauthorized access.
  • V-88251CAT IIThe vROps PostgreSQL DB must protect its audit configuration from unauthorized modification.
  • V-88253CAT IIThe vROps PostgreSQL DB must protect its audit features from unauthorized removal.
  • V-88255CAT IIvROps PostgreSQL DB objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to the DBMS, etc.) must be owned by vROps PostgreSQL DB principals authorized for ownership.
  • V-88257CAT IIThe role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the vROps PostgreSQL DB, etc.) must be restricted to authorized users.
  • V-88259CAT IIDefault demonstration and sample databases, database objects, and applications must be removed.
  • V-88261CAT IIThe vROps PostgreSQL DB must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.
  • V-88263CAT IIThe vROps PostgreSQL DB must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).
  • V-88265CAT IIIf passwords are used for authentication, the vROps PostgreSQL DB must store only hashed, salted representations of passwords.
  • V-88267CAT IIIf passwords are used for authentication, the vROps PostgreSQL DB must transmit only encrypted representations of passwords.
  • V-88269CAT IThe vROps PostgreSQL DB must use NIST FIPS 140-2 validated cryptographic modules for cryptographic operations.
  • V-88271CAT IIIn the event of a system failure, the vROps PostgreSQL DB must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes.
  • V-88273CAT IIThe vROps PostgreSQL DB must isolate security functions from non-security functions.
  • V-88275CAT IIvROps PostgreSQL DB contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.
  • V-88277CAT IIThe vROps PostgreSQL DB must reveal detailed error messages only to the ISSO, ISSM, SA and DBA.
  • V-88279CAT IIThe vROps PostgreSQL DB must utilize centralized management of the content captured in audit records generated by all components of the DBMS.
  • V-88281CAT IIThe vROps PostgreSQL DB must provide centralized configuration of the content to be captured in audit records generated by all components of the DBMS.
  • V-88283CAT IIThe vROps PostgreSQL DB must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75% of maximum audit record storage capacity.
  • V-88285CAT IIThe vROps PostgreSQL DB must provide an immediate real-time alert to appropriate support staff of all audit failure events requiring real-time alerts.
  • V-88287CAT IIThe vROps PostgreSQL DB must record time stamps, in audit records and application data that can be mapped to Coordinated Universal Time (UTC, formerly GMT).
  • V-88289CAT IIThe vROps PostgreSQL DB must generate time stamps, for audit records and application data, with a minimum granularity of one second.
  • V-88291CAT IIThe vROps PostgreSQL DB must enforce access restrictions associated with changes to the configuration of the DBMS or database(s).
  • V-88293CAT IIThe vROps PostgreSQL DB must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.
  • V-88295CAT IIWhen invalid inputs are received, the vROps PostgreSQL DB must behave in a predictable and documented manner that reflects organizational and system objectives.
  • V-88297CAT ISecurity-relevant software updates to the vROps PostgreSQL DB must be installed within the time period directed by an authoritative source (e.g. IAVM, CTOs, DTMs, and STIGs).
  • V-88299CAT IIThe vROps PostgreSQL DB must be able to generate audit records when security objects are accessed.
  • V-88301CAT IIThe vROps PostgreSQL DB must generate audit records when unsuccessful attempts to access security objects occur.
  • V-88303CAT IIThe vROps PostgreSQL DB must generate audit records when privileges/permissions are added.
  • V-88305CAT IIThe vROps PostgreSQL DB must generate audit records when unsuccessful attempts to add privileges/permissions occur.
  • V-88307CAT IIThe vROps PostgreSQL DB must generate audit records when privileges/permissions are modified.
  • V-88309CAT IIThe vROps PostgreSQL DB must generate audit records when unsuccessful attempts to modify privileges/permissions occur.
  • V-88311CAT IIThe vROps PostgreSQL DB must generate audit records when security objects are modified.
  • V-88313CAT IIThe vROps PostgreSQL DB must generate audit records when unsuccessful attempts to modify security objects occur.
  • V-88315CAT IIThe vROps PostgreSQL DB must generate audit records when privileges/permissions are deleted.
  • V-88317CAT IIThe vROps PostgreSQL DB must generate audit records when unsuccessful attempts to delete privileges/permissions occur.
  • V-88319CAT IIThe vROps PostgreSQL DB must generate audit records when security objects are deleted.
  • V-88321CAT IIThe vROps PostgreSQL DB must generate audit records when unsuccessful attempts to delete security objects occur.
  • V-88323CAT IIThe vROps PostgreSQL DB must generate audit records when categories of information (e.g., classification levels/security levels) are deleted.
  • V-88325CAT IIThe vROps PostgreSQL DB must generate audit records when successful logons or connections occur.
  • V-88327CAT IIThe vROps PostgreSQL DB must generate audit records when unsuccessful logons or connection attempts occur.
  • V-88329CAT IIThe vROps PostgreSQL DB must generate audit records for all privileged activities or other system-level access.
  • V-88331CAT IIThe vROps PostgreSQL DB must generate audit records when unsuccessful attempts to execute privileged activities or other system-level access occur.
  • V-88333CAT IIThe vROps PostgreSQL DB must generate audit records showing starting and ending time for user access to the database(s).
  • V-88335CAT IIThe vROps PostgreSQL DB must generate audit records when concurrent logons/connections by the same user from different workstations occur.
  • V-88337CAT IIThe vROps PostgreSQL DB must be able to generate audit records when successful accesses to objects occur.
  • V-88339CAT IIThe vROps PostgreSQL DB must generate audit records when unsuccessful accesses to objects occur.
  • V-88341CAT IIThe vROps PostgreSQL DB must generate audit records for all direct access to the database(s).
  • V-88343CAT IThe vROps PostgreSQL DB must implement NIST FIPS 140-2 validated cryptographic modules to provision digital signatures.
  • V-88345CAT IThe vROps PostgreSQL DB must implement NIST FIPS 140-2 validated cryptographic modules to generate and validate cryptographic hashes.
  • V-88347CAT IThe vROps PostgreSQL DB must implement NIST FIPS 140-2 validated cryptographic modules to protect unclassified information requiring confidentiality and cryptographic protection, in accordance with the data owners requirements.
  • V-88349CAT IIThe vROps PostgreSQL DB must off-load audit data to a separate log management facility; this must be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for stand-alone systems.
  • V-88351CAT IIThe vROps PostgreSQL DB must be configured in accordance with the security configuration settings based on DoD security configuration and implementation guidance, including STIGs, NSA configuration guides, CTOs, DTMs, and IAVMs.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R2 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.