The DBMS must terminate all sessions and network connections when non-local maintenance is completed.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32488	SRG-APP-000186-DB-000117	SV-42825r1_rule		Medium

Description
Non-local maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. The act of managing systems and applications includes the ability to access sensitive application information, such as system configuration details, diagnostic information, user information, and potentially sensitive application data. When applications provide a remote management capability inherent to the application, the application needs to ensure all sessions and network connections are terminated when non-local maintenance is completed. If network connections remain open they are susceptible to session hijacking activities.

Description

Non-local maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. The act of managing systems and applications includes the ability to access sensitive application information, such as system configuration details, diagnostic information, user information, and potentially sensitive application data. When applications provide a remote management capability inherent to the application, the application needs to ensure all sessions and network connections are terminated when non-local maintenance is completed. If network connections remain open they are susceptible to session hijacking activities.

STIG	Date
Database Security Requirements Guide	2012-07-02

Details

Check Text ( C-40926r1_chk )
Review DBMS vendor documentation, audit logs, and DBMS settings to verify all sessions and network connections are terminated when non-local maintenance is completed. If sessions and network connections are not terminated when non-local maintenance is complete, this is a finding.

Fix Text (F-36402r1_fix)
Configure the DBMS product to terminate all sessions and network connections when non-local maintenance is complete. If the DBMS is not capable of terminating sessions and network connections, utilize a DBMS that provides this ability.