The DBMS must provide the capability to remotely view all content related to an established user session in real time.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32367	SRG-APP-000094-DB-000177	SV-42704r1_rule		Medium

Description
While a great deal of effort is made to secure applications to prevent unauthorized access, in certain instances there can be valid requirements to listen/hear or view all content related to a particular user's application session in real time as it occurs. These instances are reserved for monitoring or investigative purposes supported through policy and are officially sanctioned. Session auditing activities are developed, integrated, and used in consultation with legal counsel in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations. These monitoring events occur at the application layer and as such, may be required to be conducted at a host system, however in some cases network monitoring may be involved, as well. Applications must support valid monitoring requirement capabilities performed in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations. This includes the capability to remotely view/hear all content related to an established user session in real time.

Description

While a great deal of effort is made to secure applications to prevent unauthorized access, in certain instances there can be valid requirements to listen/hear or view all content related to a particular user's application session in real time as it occurs. These instances are reserved for monitoring or investigative purposes supported through policy and are officially sanctioned. Session auditing activities are developed, integrated, and used in consultation with legal counsel in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations. These monitoring events occur at the application layer and as such, may be required to be conducted at a host system, however in some cases network monitoring may be involved, as well. Applications must support valid monitoring requirement capabilities performed in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations. This includes the capability to remotely view/hear all content related to an established user session in real time.

STIG	Date
Database Security Requirements Guide	2012-07-02

Details

Check Text ( C-40809r1_chk )
Verify, using vendor documentation if required, the DBMS is capable of allowing all content related to an established user session to be remotely viewed in real time. If the DBMS does not provide this capability and a third party product is not being used to provide this ability, this is a finding.

Fix Text (F-36282r1_fix)
Utilize a DBMS capable of remotely viewing, in real time, all content related to an established user session or acquire a third party application to perform this function.