UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

The DBMS must terminate the network connection associated with a communications session at the end of the session or after an organization defined time period of inactivity.


Overview

Finding ID Version Rule ID IA Controls Severity
V-32492 SRG-APP-000190-DB-000137 SV-42829r1_rule Medium
Description
Non-local maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. The act of managing systems and applications includes the ability to access sensitive application information, such as system configuration details, diagnostic information, user information, and potentially sensitive application data. When applications provide a remote management capability inherent to the application, the application needs to ensure all sessions and network connections are terminated when non-local maintenance is completed. When network connections are left open after the database session has closed, the network session is open to session hijacking.
STIG Date
Database Security Requirements Guide 2012-07-02

Details

Check Text ( C-40930r1_chk )
Review DBMS settings and vendor documentation to verify network connections are terminated when a database communications session is ended or after an organization defined period of inactivity. If the network connection is not terminated, this is a finding.
Fix Text (F-36406r1_fix)
Configure DBMS settings to disconnect network sessions when database communication sessions have ended or after an organization defined period of inactivity.