The DBMS must display the system use information when appropriate, before granting further access.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32254	SRG-APP-000070-DB-000175	SV-42571r1_rule		Medium

Description
For publicly accessible systems: Applications are required to display the following information: (i) displays the system use information when appropriate, before granting further access; (ii) displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and (iii) includes in the notice given to public users of the information system, a description of the authorized uses of the system. System use notification messages can be implemented in the form of warning banners displayed when individuals log in to the information system. System use notification is intended only for information system access that includes an interactive login interface with a human user and is not intended to require notification when an interactive interface does not exist.

Description

For publicly accessible systems: Applications are required to display the following information: (i) displays the system use information when appropriate, before granting further access; (ii) displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities; and (iii) includes in the notice given to public users of the information system, a description of the authorized uses of the system. System use notification messages can be implemented in the form of warning banners displayed when individuals log in to the information system. System use notification is intended only for information system access that includes an interactive login interface with a human user and is not intended to require notification when an interactive interface does not exist.

STIG	Date
Database Security Requirements Guide	2012-07-02

Details

Check Text ( C-40763r2_chk )
Determine whether the system is publicly accessible. If the system is not publicly accessible, this is NA. Banner requirements are applicable only to interactive accounts. Review banner displayed by DBMS to verify it displays the system use information when appropriate, before granting further access. Review banner displayed by DBMS to verify it displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities. Review banner displayed by DBMS to verify it includes in the notice given to public users of the information system, a description of the authorized uses of the system.

Check Text ( C-40763r2_chk )

Determine whether the system is publicly accessible. If the system is not publicly accessible, this is NA.
Banner requirements are applicable only to interactive accounts.

Review banner displayed by DBMS to verify it displays the system use information when appropriate, before granting further access.

Review banner displayed by DBMS to verify it displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities.

Review banner displayed by DBMS to verify it includes in the notice given to public users of the information system, a description of the authorized uses of the system.

Fix Text (F-36178r2_fix)
For interactive accounts: Configure DBMS to display a banner that displays the system use information when appropriate, before granting further access. Configure DBMS to display a banner that displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities. Configure DBMS to display a banner that includes in the notice given to public users of the information system, a description of the authorized uses of the system.

Fix Text (F-36178r2_fix)

For interactive accounts:
Configure DBMS to display a banner that displays the system use information when appropriate, before granting further access.

Configure DBMS to display a banner that displays references, if any, to monitoring, recording, or auditing that are consistent with privacy accommodations for such systems that generally prohibit those activities.

Configure DBMS to display a banner that includes in the notice given to public users of the information system, a description of the authorized uses of the system.