Details
Database passwords stored in clear text are vulnerable to unauthorized disclosure. Database passwords should always be encoded or encrypted when stored internally or externally to the DBMS.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Develop, document and maintain a list of DBMS database objects, database configuration files, associated scripts and applications defined within or external to the DBMS that access the database, and DBMS / user environment files/settings in the System Security Plan.
Record whether they do or do not contain DBMS passwords.
If passwords are present, ensure they are encoded or encrypted and protected by host system security.
Consider using vendor or 3rd party tools to support external authentication (i.e. Oracle Database Vault).
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Identification and Authentication.This control applies to the following type of system Windows.
References
- 800-53|IA-5(1)(c)
- CAT|I
- Rule-ID|SV-24641r1_rule
- STIG-ID|DG0067-ORACLE11
- Vuln-ID|V-3812