UCF STIG Viewer Logo

The DBMS must employ enterprise-level or OS-level authentication for all interactive accounts.


Overview

Finding ID Version Rule ID IA Controls Severity
V-61861 O121-N3-005801 SV-76351r2_rule Low
Description
Users need to be aware of activity that occurs regarding their application account. Providing users with information regarding the date and time of their last successful logon allows the user to determine if any unauthorized activity has occurred and gives them an opportunity to notify administrators. This requirement is intended to cover both traditional interactive logons to information systems and general accesses to information systems that occur in other types of architectural configurations (e.g., service-oriented architectures). Unauthorized access to DBMS accounts may go undetected if account access is not monitored. Authorized users may serve as a reliable party to report unauthorized use of their account. This STIG requirement mandates the implementation of a method to mitigate Oracle's inability to display the data specified in the SRG. This assumes that the operating system is capable of displaying the specified data.
STIG Date
Oracle Database 12c Security Technical Implementation Guide 2017-04-05

Details

Check Text ( C-62741r2_chk )
Run the query:

SELECT * FROM DBA_USERS WHERE PASSWORD IS NULL OR PASSWORD NOT IN ('EXTERNAL', 'GLOBAL');

If the names of any interactive accounts (other than SYS, SYSBACKUP, SYSDG, and SYSKM) are returned, this is a finding.
Fix Text (F-67777r1_fix)
Use the Oracle option of integration with enterprise-level account management (such as Active Directory or LDAP), for all accounts, including administrative accounts.