The DBMS must generate audit records when unsuccessful accesses to objects occur.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-58121	SRG-APP-000507-DB-000357	SV-72551r1_rule		Medium

Description
Without tracking all or selected types of access to all or selected objects (tables, views, procedures, functions, etc.), it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. In an SQL environment, types of access include, but are not necessarily limited to: SELECT INSERT UPDATE DELETE EXECUTE To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.

Description

Without tracking all or selected types of access to all or selected objects (tables, views, procedures, functions, etc.), it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. In an SQL environment, types of access include, but are not necessarily limited to: SELECT INSERT UPDATE DELETE EXECUTE To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.

STIG	Date
Database Security Requirements Guide	2016-11-16

Details

Check Text ( C-58891r2_chk )
Review DBMS documentation to verify that administrative users can specify database objects for which access must be audited, and can specify which kinds of access must be audited. If the DBMS is not capable of this, this is a finding. Review DBMS documentation to determine whether the application owner has specified database objects (tables, views, procedures, functions, etc.) for which access must be audited. Review the DBMS/database security and audit settings to verify that audit records are created for unsuccessful attempts at the specified access to the specified objects. If not, this is a finding.

Check Text ( C-58891r2_chk )

Review DBMS documentation to verify that administrative users can specify database objects for which access must be audited, and can specify which kinds of access must be audited.

If the DBMS is not capable of this, this is a finding.

Review DBMS documentation to determine whether the application owner has specified database objects (tables, views, procedures, functions, etc.) for which access must be audited.

Review the DBMS/database security and audit settings to verify that audit records are created for unsuccessful attempts at the specified access to the specified objects.

If not, this is a finding.

Fix Text (F-63329r1_fix)
Deploy a DBMS capable of producing the required audit records when object access occurs. Configure audit settings to create audit records when the specified access to the specified objects is unsuccessfully attempted.