UCF STIG Viewer Logo

Developers should not be assigned excessive privileges on production databases.


Overview

Finding ID Version Rule ID IA Controls Severity
V-15114 DG0089-ORACLE10 SV-24394r1_rule ECPC-1 ECPC-2 Low
Description
Developers play a unique role and represent a specific type of threat to the security of the DBMS. Where restricted resources prevent the required separation of production and development DBMS installations, developers granted elevated privileges to create and manage new database objects must also be prevented from actions that can threaten the production operation.
STIG Date
Oracle Database 10g Instance STIG 2014-04-02

Details

Check Text ( C-3819r1_chk )
If this database is not a production database, this check is Not a Finding. Review the privileges assigned to developer accounts. Identify login name of developer DBMS accounts from the System Security Plan and/or DBA. For each developer account, display the roles assigned to the account. From SQL*Plus: select granted_role from dba_role_privs where grantee=[developer account name]; If privileges assigned to developer accounts are not restricted to development objects and configurations, or authorizations to allow developer account access to production objects and configurations does not exist in the System Security Plan, this is a Finding.
Fix Text (F-2589r1_fix)
Revoke permissions and privileges that allow changes to the production system or production objects from developer accounts or authorize permissions and privileges for developer accounts in the System Security Plan.