Application owner accounts should have a dedicated application tablespace.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3849	DO0231-ORACLE11	SV-24510r2_rule	DCPA-1	Medium

Description
Separation of tablespaces by application helps to protect the application from resource contention and unauthorized access that could result from storage space reuses or host system access controls. Application data should be stored separately from system and custom user-defined objects to facilitate administration and management of its data storage. The SYSTEM tablespace should never be used for application data storage in order to prevent resource contention and performance degradation.

Description

Separation of tablespaces by application helps to protect the application from resource contention and unauthorized access that could result from storage space reuses or host system access controls. Application data should be stored separately from system and custom user-defined objects to facilitate administration and management of its data storage. The SYSTEM tablespace should never be used for application data storage in order to prevent resource contention and performance degradation.

STIG	Date
Oracle Database 11g Instance STIG	2015-03-26

Details

Check Text ( C-29426r2_chk )
From SQL*Plus (NOTE: The owner list below is a short list of all possible default Oracle accounts): select distinct owner, tablespace_name from dba_tables where owner not in ('SYS','SYSTEM','OUTLN','OLAPSYS','CTXSYS','WKSYS','ODM', 'ODM_MTR','MDSYS','ORDSYS','WMSYS','RMAN','XDB') and tablespace_name is not NULL and (owner, table_name) not in (select owner, table_name from dba_external_tables) order by tablespace_name; Review the list of returned table owners with the tablespace used. If any of the owners listed are not default Oracle accounts and use the SYSTEM or any other tablespace not dedicated for the application’s use, this is a Finding. Look for multiple applications that may share a tablespace. If no records were returned, ask the DBA if any applications use this database. If no applications use the database, this is not a Finding. If there are applications that do use the database or if the application uses the SYS or other default account and SYSTEM tablespace to store its objects, this is a Finding.

Check Text ( C-29426r2_chk )

From SQL*Plus (NOTE: The owner list below is a short list of all possible default Oracle accounts):

select distinct owner, tablespace_name
from dba_tables
where owner not in
('SYS','SYSTEM','OUTLN','OLAPSYS','CTXSYS','WKSYS','ODM',
'ODM_MTR','MDSYS','ORDSYS','WMSYS','RMAN','XDB')
and tablespace_name is not NULL
and (owner, table_name) not in
(select owner, table_name from dba_external_tables)
order by tablespace_name;

Review the list of returned table owners with the tablespace used.

If any of the owners listed are not default Oracle accounts and use the SYSTEM or any other tablespace not dedicated for the application’s use, this is a Finding.

Look for multiple applications that may share a tablespace.

If no records were returned, ask the DBA if any applications use this database.

If no applications use the database, this is not a Finding.

If there are applications that do use the database or if the application uses the SYS or other default account and SYSTEM tablespace to store its objects, this is a Finding.

Fix Text (F-26453r1_fix)
Create and assign dedicated tablespaces for the storage of data by each application using the CREATE TABLESPACE command.