The DBMS must generate audit records when security objects are deleted.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-206626	SRG-APP-000501-DB-000336	SV-206626r617447_rule		Medium

Description
The removal of security objects from the database/DBMS would seriously degrade a system's information assurance posture. If such an event occurs, it must be logged.

STIG	Date
Database Security Requirements Guide	2020-12-16

Details

Check Text ( C-6886r291546_chk )
If the DBMS architecture makes it impossible for any user, even with the highest privileges, to drop its built-in security objects, and if there are no additional, locally-defined security objects in the database(s), this is not a finding. Review DBMS documentation to verify that audit records can be produced when security objects are drop. If the DBMS is not capable of this, this is a finding. Review the DBMS/database security and audit configurations to verify that audit records are produced when security objects are drop. If they are not produced, this is a finding.

Check Text ( C-6886r291546_chk )

If the DBMS architecture makes it impossible for any user, even with the highest privileges, to drop its built-in security objects, and if there are no additional, locally-defined security objects in the database(s), this is not a finding.

Review DBMS documentation to verify that audit records can be produced when security objects are drop.

If the DBMS is not capable of this, this is a finding.

Review the DBMS/database security and audit configurations to verify that audit records are produced when security objects are drop.

If they are not produced, this is a finding.

Fix Text (F-6886r291547_fix)
Deploy a DBMS capable of producing the required audit records when security objects are deleted. Configure the DBMS to produce audit records when security objects are deleted.