The DBMS must initiate session auditing upon startup.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32365	SRG-APP-000092-DB-000208	SV-42702r2_rule		Medium

Description
Session auditing is for use when a user's activities are under investigation. To be sure of capturing all activity during those periods when session auditing is in use, it needs to be in operation for the whole time the DBMS is running.

STIG	Date
Database Security Requirements Guide	2017-11-30

Details

Check Text ( C-40807r3_chk )
Review DBMS vendor documentation to determine whether the DBMS software is capable of session auditing. If the DBMS is not capable of session auditing and a third party product is not being used for session level auditing, this is a finding. If the DBMS is capable of session level auditing and specific session audits are currently defined but session auditing is not enabled; or if a third-party product is available for session auditing and specific session audits are currently defined but session auditing is not enabled, this is a finding.

Check Text ( C-40807r3_chk )

Review DBMS vendor documentation to determine whether the DBMS software is capable of session auditing.

If the DBMS is not capable of session auditing and a third party product is not being used for session level auditing, this is a finding.

If the DBMS is capable of session level auditing and specific session audits are currently defined but session auditing is not enabled; or if a third-party product is available for session auditing and specific session audits are currently defined but session auditing is not enabled, this is a finding.

Fix Text (F-36280r3_fix)
Deploy a DBMS capable of session auditing. Configure the DBMS software or third-party product to enable session auditing.