Details

Lost or compromised DBMS backup and restoration files may lead to not only the loss of data, but also the unauthorized access to sensitive data. Backup files need the same protections against unauthorized access when stored on backup media as when online and actively in use by the database system. In addition, the backup media needs to be protected against physical loss. Most DBMSs maintain online copies of critical control files to provide transparent or easy recovery from hard disk loss or other interruptions to database operation.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Develop, document and implement protection for backup and restoration files.

Document personnel and the level of access authorized for each to backup and restoration files and tools.

In addition to physical and host system protections, consider other methods including password protection of the files.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_11g_Y21M10_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Contingency Planning.This control applies to the following type of system Windows.

References

• 800-53|CP-9
• CAT|II
• Rule-ID|SV-24637r1_rule
• STIG-ID|DG0064-ORACLE11
• Vuln-ID|V-15120

Source

• Tenable.com/audits