The DBMS host platform and other dependent applications must be configured in compliance with applicable STIG requirements.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-61491	O121-BP-024300	SV-75981r1_rule		Medium

Description
The security of the data stored in the DBMS is also vulnerable to attacks against the host platform, calling applications, and other application or optional components.

STIG	Date
Oracle Database 12c Security Technical Implementation Guide	2018-02-28

Details

Check Text ( C-62363r1_chk )
If the DBMS host being reviewed is not a production DBMS host, this check is not a finding. Review evidence of security hardening and auditing of the DBMS host platform with the ISSO. If the DBMS host platform has not been hardened and received a security audit, this is a finding. Review evidence of security hardening and auditing for all application(s) that store data in the database and all other separately configured components that access the database including web servers, application servers, report servers, etc. If any have not been hardened and received a security audit, this is a finding. Review evidence of security hardening and auditing for all application(s) installed on the local DBMS host where security hardening and auditing guidance exists. If any have not been hardened and received a security audit, this is a finding.

Check Text ( C-62363r1_chk )

If the DBMS host being reviewed is not a production DBMS host, this check is not a finding.

Review evidence of security hardening and auditing of the DBMS host platform with the ISSO.

If the DBMS host platform has not been hardened and received a security audit, this is a finding.

Review evidence of security hardening and auditing for all application(s) that store data in the database and all other separately configured components that access the database including web servers, application servers, report servers, etc.

If any have not been hardened and received a security audit, this is a finding.

Review evidence of security hardening and auditing for all application(s) installed on the local DBMS host where security hardening and auditing guidance exists.

If any have not been hardened and received a security audit, this is a finding.

Fix Text (F-67407r1_fix)
Configure all related application components and the DBMS host platform in accordance with the applicable DoD STIG. Regularly audit the security configuration of related applications and the host platform to confirm continued compliance with security requirements.