| If the application owner and Authorizing Official have determined that encryption of data at rest is NOT required, this is not a finding. |
Review DBMS settings to determine whether controls exist to protect the confidentiality and integrity of data at rest in the database.
If controls do not exist or are not enabled, this is a finding.
To ensure that the appropriate controls are in place, discuss the precautions taken with the site Database Administrators and System Administrators and try to modify data at rest.
Oracle recommends using Transparent Data Encryption to protect data.
To check to see if the data is encrypted, for example, upon an auditor's request Oracle provides views that document the encryption status of the database. For TDE column encryption, use the view "dba_encrypted_columns", which lists the owner, table name, column name, encryption algorithm, and salt for all encrypted columns. For TDE tablespace encryption, the following SQL statement lists all encrypted tablespaces with their encryption algorithm and corresponding, encrypted, data files. Issue the following commands to check to see if the data at rest is encrypted.
$ sqlplus connect as sysdba
SQL> SELECT t.name "TSName",
d.file_name "File Name"
FROM v$tablespace t,
WHERE t.ts# = e.ts#
and t.name = d.tablespace_name;
The next SQL statement lists the table owner, tables within encrypted tablespaces, and the encryption algorithm:
SQL> SELECT a.owner "Owner",
a.table_name "Table Name",
FROM dba_tables a,
WHERE a.tablespace_name in (select t.name from v$tablespace t, v$encrypted_tablespaces e where t.ts# = e.ts#);