The DBMS must provide the capability to immediately disconnect or disable remote access to the information system.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-58047	SRG-APP-000316-DB-000313	SV-72477r1_rule		Medium

Description
Without the ability to immediately disconnect or disable remote access, an attack or other compromise in progress would not be immediately stopped. The capability must exist to immediately disconnect current users remotely accessing the information system and/or disable further remote access. The speed of disconnect or disablement varies based on the criticality of missions/business functions and the need to eliminate immediate or future remote access to organizational information systems. The remote access application (e.g., VPN client) may implement features such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack.

Description

Without the ability to immediately disconnect or disable remote access, an attack or other compromise in progress would not be immediately stopped. The capability must exist to immediately disconnect current users remotely accessing the information system and/or disable further remote access. The speed of disconnect or disablement varies based on the criticality of missions/business functions and the need to eliminate immediate or future remote access to organizational information systems. The remote access application (e.g., VPN client) may implement features such as automatic disconnect (or user-initiated disconnect) in case of adverse information based on an indicator of compromise or attack.

STIG	Date
Database Security Requirements Guide	2015-12-21

Details

Check Text ( C-58817r1_chk )
Review the DBMS architecture and deployment. If the capability to immediately disconnect current users remotely accessing the information system and/or disable further remote access does not exist, this is a finding.

Fix Text (F-63255r1_fix)
Deploy a DBMS with the capability to immediately disconnect current users remotely accessing the information system, and disable further remote access. Enable the capability to immediately disconnect current users remotely accessing the information system and/or disable further remote access.