The DBMS must maintain and support organization defined security labels on stored information.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32163	SRG-APP-000006-DB-000183	SV-42480r1_rule		Medium

Description
Security attributes are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information. These attributes are typically associated with internal data structures (e.g., records, buffers, files) within the information system and are used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy. One example includes marking data as classified or FOUO. These security attributes may be assigned manually or during data processing but either way, it is imperative these assignments are maintained while the data is in storage. If the security attributes are lost when the data is stored, there is the risk of a data compromise. The sensitivity marking or labeling of stored data items promotes the correct handling and protection of data. Without such notification, the user may unwittingly disclose sensitive data to unauthorized users.

Description

Security attributes are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information. These attributes are typically associated with internal data structures (e.g., records, buffers, files) within the information system and are used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy. One example includes marking data as classified or FOUO. These security attributes may be assigned manually or during data processing but either way, it is imperative these assignments are maintained while the data is in storage. If the security attributes are lost when the data is stored, there is the risk of a data compromise. The sensitivity marking or labeling of stored data items promotes the correct handling and protection of data. Without such notification, the user may unwittingly disclose sensitive data to unauthorized users.

STIG	Date
Database Security Requirements Guide	2012-07-02

Details

Check Text ( C-40676r2_chk )
Review system documentation to determine if the labeling of sensitive data is required under organization defined guidelines. If the labeling of sensitive data is not required, this is NA. Review the DBMS configuration regarding the marking and labeling of stored information. If stored information is not being labeled with the organization defined security labels, this is a finding.

Fix Text (F-36086r1_fix)
Document the appropriate organization defined security labels in the system documentation. Configure the DBMS to label sensitive data, stored within the DBMS, with organization defined labels.