The DBMS must support taking organization defined list of least disruptive actions to terminate suspicious events.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32592	SRG-APP-000287-DB-000126	SV-42929r1_rule		Medium

Description
System availability is a key tenet of system security. Organizations need to have the flexibility to be able to define the automated actions taken in response to an identified incident. This includes being able to define a least disruptive action the application takes to terminate suspicious events. A least disruptive action may include initiating a request for human response rather than blocking traffic or disrupting system operation. In order to preserve availability, it is important for the DBMS to terminate suspicious events with the least disruptive action possible. If suspicious events are not terminated an attacker may gain entry into the system, however, if the system overreacts to a suspicious event and takes an overly disruptive action a Denial of Service (DoS) may occur.

Description

System availability is a key tenet of system security. Organizations need to have the flexibility to be able to define the automated actions taken in response to an identified incident. This includes being able to define a least disruptive action the application takes to terminate suspicious events. A least disruptive action may include initiating a request for human response rather than blocking traffic or disrupting system operation. In order to preserve availability, it is important for the DBMS to terminate suspicious events with the least disruptive action possible. If suspicious events are not terminated an attacker may gain entry into the system, however, if the system overreacts to a suspicious event and takes an overly disruptive action a Denial of Service (DoS) may occur.

STIG	Date
Database Security Requirements Guide	2012-07-02

Details

Check Text ( C-41031r1_chk )
Review DBMS configuration to verify the database will be subject to the least disruptive action to terminate suspicious events. The DBMS must take action from an organization defined list of least disruptive actions. If it does not, this is a finding.

Fix Text (F-36506r1_fix)
Configure the DBMS to take the least disruptive action from an organization defined list of actions to terminate suspicious events when suspicious events occur.