Details
Production, development and other non-production DBMS installations have different access and security requirements. Shared production/non-production DBMS installations secured at a production-level can impede development efforts whereas production/non-production DBMS installations secured at a development-level can lead to exploitation of production-level installations. Production DBMS installations should be kept separate from development, QA, TEST and other non-production DBMS systems.
Solution
Recommend establishing a dedicated DBMS host for production DBMS installations (See Checks DG0109 and DG0110).
A dedicated host system in this case refers to an instance of the operating system at a minimum.
The operating system may reside on a virtual host machine where supported by the DBMS vendor.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Windows.
References
- 800-53|CM-7a.
- CAT|II
- Rule-ID|SV-24606r1_rule
- STIG-ID|DG0017-ORACLE11
- Vuln-ID|V-3803