Database software, applications and configuration files should be monitored to discover unauthorized changes.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-2423	DG0050-ORACLE11	SV-24383r1_rule	DCSL-1 DCSW-1	Medium

Description
Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.

STIG	Date
Oracle Database 11g Installation STIG	2014-04-02

Details

Check Text ( C-29147r1_chk )
Review documented software and configuration monitoring procedures and implementation evidence to verify that monitoring of changes to database software libraries, related applications and configuration files is being performed weekly or more often. Verify that a list of files and directories being monitored is complete. If monitoring is not being performed weekly or more often, this is a Finding. If implementation evidence is not complete, this is a Finding.

Check Text ( C-29147r1_chk )

Review documented software and configuration monitoring procedures and implementation evidence to verify that monitoring of changes to database software libraries, related applications and configuration files is being performed weekly or more often.

Verify that a list of files and directories being monitored is complete.

If monitoring is not being performed weekly or more often, this is a Finding.

If implementation evidence is not complete, this is a Finding.

Fix Text (F-26156r1_fix)
Develop, document and implement procedures to monitor for unauthorized changes to DBMS software libraries, related software application libraries and configuration files. If a third-party automated tool is not employed, an automated job that reports file information on the directories and files of interest and compares them to the baseline report for the same will meet the requirement. File hashes or checksums should be used for comparisons as file dates may be manipulated by malicious users.

Fix Text (F-26156r1_fix)

Develop, document and implement procedures to monitor for unauthorized changes to DBMS software libraries, related software application libraries and configuration files.

If a third-party automated tool is not employed, an automated job that reports file information on the directories and files of interest and compares them to the baseline report for the same will meet the requirement.

File hashes or checksums should be used for comparisons as file dates may be manipulated by malicious users.