Database data files containing sensitive information must be encrypted.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32499	SRG-APP-000196-DB-000141	SV-42836r1_rule		Medium

Description
Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Data files that are not encrypted are vulnerable to theft. When data files are not encrypted they can be copied and opened on a separate system. The data can be compromised without the information owner's knowledge that the theft has even taken place.

Description

Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Data files that are not encrypted are vulnerable to theft. When data files are not encrypted they can be copied and opened on a separate system. The data can be compromised without the information owner's knowledge that the theft has even taken place.

STIG	Date
Database Security Requirements Guide	2012-07-02

Details

Check Text ( C-40937r2_chk )
Review the system documentation to determine whether the database handles classified information. If the database handles classified information, upgrade the severity Category Code to I. Review the system documentation to discover sensitive or classified data identified by the Information Owner that requires encryption. If no sensitive or classified data is identified as requiring encryption by the Information Owner, this is not a finding. Have the DBA use select statements in the database to review sensitive data stored in tables as identified in the system documentation. If all sensitive data identified is encrypted within the database objects, encryption of the DBMS data files is optional and not a finding. If all sensitive data is not encrypted within database objects, review encryption applied to the DBMS host data files. If no encryption is applied, this is a finding.

Check Text ( C-40937r2_chk )

Review the system documentation to determine whether the database handles classified information. If the database handles classified information, upgrade the severity Category Code to I.

Review the system documentation to discover sensitive or classified data identified by the Information Owner that requires encryption. If no sensitive or classified data is identified as requiring encryption by the Information Owner, this is not a finding.

Have the DBA use select statements in the database to review sensitive data stored in tables as identified in the system documentation.

If all sensitive data identified is encrypted within the database objects, encryption of the DBMS data files is optional and not a finding.

If all sensitive data is not encrypted within database objects, review encryption applied to the DBMS host data files. If no encryption is applied, this is a finding.

Fix Text (F-36414r1_fix)
Use third-party tools or native DBMS features to encrypt sensitive or classified data stored in the database.