Details

Without maintenance of a baseline of current DBMS application software, monitoring for changes cannot be complete and unauthorized changes to the software can go undetected. Changes to the DBMS executables could be the result of intentional or unintentional actions.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Develop, document and implement DBMS software baseline procedures that include all DBMS software files and directories under the ORACLE_BASE and ORACLE_HOME environment variables and any custom and platform-specific directories.

Generate a list of files, directories and details for the DBMS software configuration baseline.

Update the configuration baseline after new installations, upgrades/updates or maintenance activities that include changes to the baseline software.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_11g_Y21M10_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Windows.

References

• 800-53|CM-8
• CAT|II
• Rule-ID|SV-24610r1_rule
• STIG-ID|DG0021-ORACLE11
• Vuln-ID|V-3806

Source

• Tenable.com/audits