The DBMS must support organizational requirements to implement separation of duties through assigned information access authorizations.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-61809	O121-C3-003300	SV-76299r1_rule		Low

Description
Separation of duties is a prevalent Information Technology control that is implemented at different layers of the information system, including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires that the person accountable for approving an action is not the same person who is tasked with implementing or carrying out that action. Additionally, the person or entity accountable for monitoring the activity must be separate as well. To meet this requirement, applications, when applicable, shall be divided where functionality is based on roles and duties. Examples of separation of duties include: (i) mission functions and distinct information system support functions are divided among different individuals/roles; (ii) different individuals perform information system support functions (e.g., system management, systems programming, configuration management, quality assurance and testing, network security); (iii) security personnel who administer access control functions do not administer audit functions; and (iv) different administrator accounts for different roles. Privileges granted outside the role of the application user job function are more likely to go unmanaged or without oversight for authorization. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment.

Description

Separation of duties is a prevalent Information Technology control that is implemented at different layers of the information system, including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires that the person accountable for approving an action is not the same person who is tasked with implementing or carrying out that action. Additionally, the person or entity accountable for monitoring the activity must be separate as well. To meet this requirement, applications, when applicable, shall be divided where functionality is based on roles and duties. Examples of separation of duties include: (i) mission functions and distinct information system support functions are divided among different individuals/roles; (ii) different individuals perform information system support functions (e.g., system management, systems programming, configuration management, quality assurance and testing, network security); (iii) security personnel who administer access control functions do not administer audit functions; and (iv) different administrator accounts for different roles. Privileges granted outside the role of the application user job function are more likely to go unmanaged or without oversight for authorization. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment.

STIG	Date
Oracle Database 12c Security Technical Implementation Guide	2015-12-21

Details

Check Text ( C-62687r1_chk )
Obtain a list of privileges assigned to the DBMS user accounts. If any direct privilege assignments exist that can be assigned to a role, this is a finding. Obtain a list of privileges assigned to the DBMS user accounts: SQL>select * from dba_sys_privs where grantee='DBA' order by privilege; Check to see what roles are assigned to a user: SQL>select * from user_role_privs; Check to see what privileges are assigned to a role: SQL>select * from role_sys_privs; Show privileges by object: set linesize 121 col table_name format a32 col select_priv format a10 col insert_priv format a10 col update_priv format a10 col delete_priv format a10 SELECT table_name, grantee, MAX(DECODE(privilege, 'SELECT', 'SELECT')) AS select_priv, MAX(DECODE(privilege, 'DELETE', 'DELETE')) AS delete_priv, MAX(DECODE(privilege, 'UPDATE', 'UPDATE')) AS update_priv, MAX(DECODE(privilege, 'INSERT', 'INSERT')) AS insert_priv FROM dba_tab_privs WHERE grantee IN ( SELECT role FROM dba_roles) GROUP BY table_name, grantee; This query will list the system privileges assigned to a specific user: SELECT LPAD(' ', 2*level) \|\| granted_role "USER PRIVS" FROM ( SELECT NULL grantee, username granted_role FROM dba_users WHERE username LIKE UPPER('%&uname%') UNION SELECT grantee, granted_role FROM dba_role_privs UNION SELECT grantee, privilege FROM dba_sys_privs) START WITH grantee IS NULL CONNECT BY grantee = prior granted_role; Data Dictionary Objects Related To System Privileges: all_sys_privs session_privs user_sys_privs dba_sys_privs system_privilege_map

Check Text ( C-62687r1_chk )

Obtain a list of privileges assigned to the DBMS user accounts.

If any direct privilege assignments exist that can be assigned to a role, this is a finding.

Obtain a list of privileges assigned to the DBMS user accounts:
SQL>select * from dba_sys_privs where grantee='DBA' order by privilege;

Check to see what roles are assigned to a user:
SQL>select * from user_role_privs;

Check to see what privileges are assigned to a role:
SQL>select * from role_sys_privs;

Show privileges by object:
set linesize 121
col table_name format a32
col select_priv format a10
col insert_priv format a10
col update_priv format a10
col delete_priv format a10

SELECT table_name, grantee,
MAX(DECODE(privilege, 'SELECT', 'SELECT')) AS select_priv,
MAX(DECODE(privilege, 'DELETE', 'DELETE')) AS delete_priv,
MAX(DECODE(privilege, 'UPDATE', 'UPDATE')) AS update_priv,
MAX(DECODE(privilege, 'INSERT', 'INSERT')) AS insert_priv
FROM dba_tab_privs
WHERE grantee IN (
SELECT role
FROM dba_roles)
GROUP BY table_name, grantee;

This query will list the system privileges assigned to a specific user:
SELECT LPAD(' ', 2*level) || granted_role "USER PRIVS"
FROM (
SELECT NULL grantee, username granted_role
FROM dba_users
WHERE username LIKE UPPER('%&uname%')
UNION
SELECT grantee, granted_role
FROM dba_role_privs
UNION
SELECT grantee, privilege
FROM dba_sys_privs)
START WITH grantee IS NULL
CONNECT BY grantee = prior granted_role;

Data Dictionary Objects Related To System Privileges:

all_sys_privs
session_privs
user_sys_privs
dba_sys_privs
system_privilege_map

Fix Text (F-67725r1_fix)
Define DBMS user roles based on privilege and job function requirements. Assign the required privileges to the role, and assign the role to authorized DBMS user accounts. Revoke any privileges directly assigned to DBMS user accounts, and assign them to a role the DBMS user already has assigned.