Application user privilege assignment must be reviewed monthly or more frequently to ensure compliance with least privilege and documented policy.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-61455	O121-BP-023400	SV-75945r1_rule		Medium

Description
Users granted privileges not required to perform their assigned functions are able to make unauthorized modifications to the production data or database. Monthly or more frequent periodic review of privilege assignments assures that organizational and/or functional changes are reflected appropriately.

STIG	Date
Oracle Database 12c Security Technical Implementation Guide	2018-01-03

Details

Check Text ( C-62345r1_chk )
Review policy, procedures and implementation evidence to determine if periodic reviews of user privileges by the ISSO are being performed. Evidence may consist of email or other correspondence that acknowledges receipt of periodic reports and notification of review between the DBA and ISSO or other auditors as assigned. If policy and procedures are incomplete or no evidence of implementation exists, this is a finding.

Check Text ( C-62345r1_chk )

Review policy, procedures and implementation evidence to determine if periodic reviews of user privileges by the ISSO are being performed.

Evidence may consist of email or other correspondence that acknowledges receipt of periodic reports and notification of review between the DBA and ISSO or other auditors as assigned.

If policy and procedures are incomplete or no evidence of implementation exists, this is a finding.

Fix Text (F-67371r1_fix)
Develop, document and implement policy and procedures for periodic review of database user accounts and privilege assignments. Include methods to provide evidence of review in the procedures to verify reviews occur in accordance with the procedures.