UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

DBMS symmetric keys must be protected in accordance with NSA- or NIST-approved key management technology or processes.


Overview

Finding ID Version Rule ID IA Controls Severity
V-54067 O112-BP-026100 SV-68307r2_rule Medium
Description
Symmetric keys used for encryption protect data from unauthorized access. However, if not protected in accordance with acceptable standards, the keys themselves may be compromised and used for unauthorized data access.
STIG Date
Oracle Database 11.2g Security Technical Implementation Guide 2016-12-15

Details

Check Text ( C-54851r3_chk )
If the symmetric key management procedures and configuration settings for the DBMS are not specified in the System Security Plan, this is a finding.

If the procedures are not followed, with evidence for audit, this is a finding.

Note: This check does not include a review of the key management procedures for validity. Specific key management requirements may be covered under separate checks.
Fix Text (F-58909r3_fix)
Implement the following for symmetric and other encryption keys:

- protection from unauthorized access in transit and in storage
- utilization of accepted algorithms
- generation in accordance with required standards for the key's use
- expiration date
- continuity - key backup and recovery
- key change
- archival key storage (as necessary)

Details for key management requirements are provided by FIPS 140-2 key management standards available from NIST.