Required object auditing should be configured.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2562	DO3610-ORACLE11	SV-24928r1_rule	ECAR-1	Medium

Description
Database object definitions and configurations require similar oversight as application libraries to detect unauthorized changes. Unauthorized changes may indicate attempts to compromise data or application object integrity or confidentiality. Any access to audit data objects stored in the database must be audited to detect any attempts to compromise the audit trail. A compromise to audit data could jeopardize accountability for unauthorized actions.

Description

Database object definitions and configurations require similar oversight as application libraries to detect unauthorized changes. Unauthorized changes may indicate attempts to compromise data or application object integrity or confidentiality. Any access to audit data objects stored in the database must be audited to detect any attempts to compromise the audit trail. A compromise to audit data could jeopardize accountability for unauthorized actions.

STIG	Date
Oracle 11 Database Instance STIG	2014-01-14

Details

Check Text ( None )
None

Fix Text (F-26541r1_fix)
The only application objects auditing required is for use of the RENAME privilege on database objects. Configure auditing on RENAME privilege use by default for newly created objects. From SQLPlus: audit rename on default by access; If application objects have already been created, the audit rename on object statement should be issued for all application objects. From SQLPlus: audit rename on [application object name] by access; Enable auditing of access and activity on audit trail data stored in the database. From SQL*Plus: audit update, delete on AUD$ by access; NOTE: The audit table is by default in the SYSTEM schema, but may have been moved to another schema.

Fix Text (F-26541r1_fix)

The only application objects auditing required is for use of the RENAME privilege on database objects.

Configure auditing on RENAME privilege use by default for newly created objects.

From SQL*Plus:

audit rename on default by access;

If application objects have already been created, the audit rename on object statement should be issued for all application objects.

From SQL*Plus:

audit rename on [application object name] by access;

Enable auditing of access and activity on audit trail data stored in the database.

From SQL*Plus:

audit update, delete on AUD$ by access;

NOTE: The audit table is by default in the SYSTEM schema, but may have been moved to another schema.