Connections by mid-tier web and application systems to the Oracle DBMS should be protected, encrypted and authenticated according to database, web, application, enclave and network requirements.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3440	DO0360-ORACLE11	SV-24537r1_rule	IAGA-1	Medium

Description
Multi-tier systems may be configured with the database and connecting middle-tier system located on an internal network, with the database located on an internal network behind a firewall and the middle-tier system located in a DMZ. In cases where systems are located in the DMZ, network communications between both systems must be encrypted. In all cases, the application account requires PKI authentication. IP address restriction to the backend database system, under a separate requirement, provides an additional level of protection.

Description

Multi-tier systems may be configured with the database and connecting middle-tier system located on an internal network, with the database located on an internal network behind a firewall and the middle-tier system located in a DMZ. In cases where systems are located in the DMZ, network communications between both systems must be encrypted. In all cases, the application account requires PKI authentication. IP address restriction to the backend database system, under a separate requirement, provides an additional level of protection.

STIG	Date
Oracle 11 Database Installation STIG	2014-01-14

Details

Check Text ( None )
None

Fix Text (F-26517r1_fix)
Configure PKI authentication to help protect access to the shared account. PKI authentication may be accomplished using Oracle Advanced Security on most platforms. On a Windows host, user authentication using PKI may be used with Active Directory or NTS authentication using the DoD CAC. On UNIX and other hosts, Oracle Advanced Security may used to authenticate via LDAP or SSL. The application may require storage of the authentication certificate in the Oracle Wallet or on a hardware security module (HSM) to authenticate. Please see the Oracle Security Guides and the Oracle Advanced Security Guides for instructions on configuring PKI authentication.

Fix Text (F-26517r1_fix)

Configure PKI authentication to help protect access to the shared account.

PKI authentication may be accomplished using Oracle Advanced Security on most platforms.

On a Windows host, user authentication using PKI may be used with Active Directory or NTS authentication using the DoD CAC.

On UNIX and other hosts, Oracle Advanced Security may used to authenticate via LDAP or SSL.

The application may require storage of the authentication certificate in the Oracle Wallet or on a hardware security module (HSM) to authenticate.

Please see the Oracle Security Guides and the Oracle Advanced Security Guides for instructions on configuring PKI authentication.