Details

New accounts authenticated by passwords that are created without a password or with an easily guessed password are vulnerable to unauthorized access. Procedures for creating new accounts with passwords should include the required assignment of a temporary password to be modified by the user upon first use.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Develop, document and implement procedures for assigning, distributing and changing of temporary passwords for new database user accounts.

Procedures should include instruction that meet current DoD password length and complexity requirements and provide a secure method to relay the temporary password to the user.

Temporary passwords should also be short-lived and require immediate update by the user upon first use.

Consider using account authentication using certificates or other credentials in place of password authentication.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_11g_Y21M10_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Identification and Authentication.This control applies to the following type of system Windows.

References

• 800-53|IA-5(1)(f)
• CAT|II
• Rule-ID|SV-24639r1_rule
• STIG-ID|DG0066-ORACLE11
• Vuln-ID|V-3811

Source

• Tenable.com/audits