Details

Changes to the security configuration must be tracked.

This requirement applies to situations where security data is retrieved or modified via data manipulation operations, as opposed to via specialized security functionality.

In SQL environment, types of access include, but are not necessarily limited to:

SELECT

INSERT

UPDATE

DELETE

EXECUTE

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

If currently required, configure the MySQL Database Server to produce audit records when security objects are accessed.

See the supplemental file ‘MySQL80Audit.sql’.

Supportive Information

The following resource is also helpful.

• https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_MySQL_8-0_V1R2_STIG.zip

This security hardening control applies to the following category of controls within NIST 800-53: Audit and Accountability.This control applies to the following type of system Unix.

References

• 800-53|AU-12c.
• CAT|II
• CCI|CCI-000172
• Rule-ID|SV-235107r623443_rule
• STIG-ID|MYS8-00-002000
• Vuln-ID|V-235107

Source

• Tenable.com/audits