All use of privileged accounts must be audited.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-52389	O112-C2-004200	SV-66605r2_rule		Medium

Description
This is intended to limit exposure, by making it possible to trace any unauthorized access, by a privileged user account or role that has permissions on security functions or security-relevant information, to other data or functionality.

STIG	Date
Oracle Database 11.2g Security Technical Implementation Guide	2019-09-27

Details

Check Text ( C-54425r2_chk )
Review auditing configuration. If it is possible for a privileged user/role to access non-security functions or information, without having the action recorded in the audit log, this is a finding.

Fix Text (F-57211r2_fix)
Configure DBMS auditing so that all use of privileged accounts is recorded in the audit log.