Details

Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Develop, document and implement procedures to monitor for unauthorized changes to DBMS software libraries, related software application libraries and configuration files.

If a third-party automated tool is not employed, an automated job that reports file information on the directories and files of interest and compares them to the baseline report for the same will meet the requirement.

File hashes or checksums should be used for comparisons as file dates may be manipulated by malicious users.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_11g_Y21M10_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Audit and Accountability.This control applies to the following type of system Windows.

References

• 800-53|AU-12c.
• CAT|II
• Rule-ID|SV-24383r1_rule
• STIG-ID|DG0050-ORACLE11
• Vuln-ID|V-2423

Source

• Tenable.com/audits