UCF STIG Viewer Logo

Application object owner accounts should be disabled when not performing installation or maintenance actions.


Overview

Finding ID Version Rule ID IA Controls Severity
V-5683 DG0004-ORACLE11 SV-24589r1_rule ECLP-1 Medium
Description
Object ownership provides all database object permissions to the owned object. Access to the application object owner accounts requires special protection to prevent unauthorized access and use of the object ownership privileges. In addition to the high privileges to application objects assigned to this account, it is also an account that, by definition, is not accessed interactively except for application installation and maintenance. This reduced access to the account means that unauthorized access to the account could go undetected. To help protect the account, it should be enabled only when access is required.
STIG Date
Oracle 11 Database Instance STIG 2014-01-14

Details

Check Text ( None )
None
Fix Text (F-15683r1_fix)
Disable any application object owner accounts.

From SQL*Plus:
alter user [username] account lock;

Enable application object owner accounts only for installation and maintenance.

DBA are special purpose accounts and do not require disabling although they may own objects.

For application objects that require routine maintenance, e.g. index objects, to maintain performance, consider allowing a special purpose account to own the index or enable the application owner account for the duration of the routine maintenance function only.