Transaction logs should be periodically reviewed for unauthorized modification of data. Users should be notified of time and date of the last change in data content.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-15133	DG0031-ORACLE11	SV-24618r1_rule	ECCD-1 ECCD-2	Medium

Description
Unauthorized or malicious changes to data compromise the integrity and usefulness of the data. Auditing changes to data supports accountability and non-repudiation. Auditing changes to data may be provided by the application accessing the DBMS or may depend upon the DBMS auditing functions. When DBMS auditing is used, the DBA is responsible for ensuring the auditing configuration meets the application design requirements.

Description

Unauthorized or malicious changes to data compromise the integrity and usefulness of the data. Auditing changes to data supports accountability and non-repudiation. Auditing changes to data may be provided by the application accessing the DBMS or may depend upon the DBMS auditing functions. When DBMS auditing is used, the DBA is responsible for ensuring the auditing configuration meets the application design requirements.

STIG	Date
Oracle 11 Database Instance STIG	2014-01-14

Details

Check Text ( C-1129r1_chk )
If the application does not require auditing using DBMS features, this check is Not Applicable. Review the application System Security Plan for requirements for database configuration for auditing changes to application data. If the application requires DBMS auditing for changes to data, review the database audit configuration against the application requirement. If the auditing does not comply with the requirement, this is a Finding. Review policy and procedures for reviewing access and changes to data. If policy and procedures are not in place, this is a Finding. If access and changes to data are not periodically reviewed or immediately reviewed on system security events, this is a Finding. If mechanisms are not in place to notify users of time and date of the last change in data content, this is a Finding.

Check Text ( C-1129r1_chk )

If the application does not require auditing using DBMS features, this check is Not Applicable.

Review the application System Security Plan for requirements for database configuration for auditing changes to application data.

If the application requires DBMS auditing for changes to data, review the database audit configuration against the application requirement. If the auditing does not comply with the requirement, this is a Finding.

Review policy and procedures for reviewing access and changes to data.

If policy and procedures are not in place, this is a Finding.

If access and changes to data are not periodically reviewed or immediately reviewed on system security events, this is a Finding.

If mechanisms are not in place to notify users of time and date of the last change in data content, this is a Finding.

Fix Text (F-2549r1_fix)
Configure database data auditing to comply with the requirements of the application. Document auditing requirements in the System Security Plan. Develop, document and implement policy and procedures for reviewing access and changes to data periodically or immediately upon system security events. Develop, document and implement mechanisms to notify users of time and date of the last change in data content.

Fix Text (F-2549r1_fix)

Configure database data auditing to comply with the requirements of the application.

Document auditing requirements in the System Security Plan.

Develop, document and implement policy and procedures for reviewing access and changes to data periodically or immediately upon system security events.

Develop, document and implement mechanisms to notify users of time and date of the last change in data content.