1.1 Ensure the Appropriate Version/Patches for Oracle Software Is Installed

800-53|CM-7(5)

CSCv6|2

CSCv7|2.2

2.2.1 Ensure 'AUDIT_SYS_OPERATIONS' Is Set to 'TRUE'

800-53|AU-3

800-53|AU-12

CSCv6|5.4

CSCv6|6.2

CSCv7|4.8

CSCv7|6.2

CSCv7|6.3

2.2.2 Ensure 'AUDIT_TRAIL' Is Set to 'DB', 'XML', 'OS', 'DB,EXTENDED', or 'XML,EXTENDED'

CSCv6|6

2.2.3 Ensure 'GLOBAL_NAMES' Is Set to 'TRUE'

800-53|AC-3

CSCv6|9

CSCv7|14.6

2.2.4 Ensure 'O7_DICTIONARY_ACCESSIBILITY' Is Set to 'FALSE'

800-53|SI-4

CSCv6|9.1

CSCv7|9.2

2.2.5 Ensure 'OS_ROLES' Is Set to 'FALSE'

CSCv6|16

CSCv6|18

2.2.7 Ensure 'REMOTE_LOGIN_PASSWORDFILE' Is Set to 'NONE'

800-53|AC-2(1)

CSCv7|16.2

2.2.8 Ensure 'REMOTE_OS_AUTHENT' Is Set to 'FALSE'

800-53|IA-2

2.2.9 Ensure 'REMOTE_OS_ROLES' Is Set to 'FALSE'

800-53|AC-6(10)

CSCv7|4.7

2.2.11 Ensure 'SEC_CASE_SENSITIVE_LOGON' Is Set to 'TRUE'

800-53|IA-5(1)

CSCv7|4.4

2.2.12 Ensure 'SEC_MAX_FAILED_LOGIN_ATTEMPTS' Is '3' or Less

800-53|AC-2

CSCv6|16.7

CSCv7|16.7

2.2.13 Ensure 'SEC_PROTOCOL_ERROR_FURTHER_ACTION' Is Set to 'DROP,3'

2.2.14 Ensure 'SEC_PROTOCOL_ERROR_TRACE_ACTION' Is Set to 'LOG'

2.2.15 Ensure 'SEC_RETURN_SERVER_RELEASE_BANNER' Is Set to 'FALSE'

2.2.16 Ensure 'SQL92_SECURITY' Is Set to 'TRUE'

2.2.17 Ensure '_trace_files_public' Is Set to 'FALSE'

CSCv6|14.4

2.2.18 Ensure 'RESOURCE_LIMIT' Is Set to 'TRUE'

3.1 Ensure 'FAILED_LOGIN_ATTEMPTS' Is Less than or Equal to '5'

3.2 Ensure 'PASSWORD_LOCK_TIME' Is Greater than or Equal to '1'

3.3 Ensure 'PASSWORD_LIFE_TIME' Is Less than or Equal to '90'

800-53|AC-1

3.4 Ensure 'PASSWORD_REUSE_MAX' Is Greater than or Equal to '20'

3.5 Ensure 'PASSWORD_REUSE_TIME' Is Greater than or Equal to '365'

3.6 Ensure 'PASSWORD_GRACE_TIME' Is Less than or Equal to '5'

800-53|AC-2(3)

CSCv7|16.9

CSCv7|16.10

3.7 Ensure 'PASSWORD_VERIFY_FUNCTION' Is Set for All Profiles

3.8 Ensure 'SESSIONS_PER_USER' Is Less than or Equal to '10'

3.9 Ensure 'INACTIVE_ACCOUNT_TIME' Is Less than or Equal to '120'

4.1 Ensure All Default Passwords Are Changed

800-53|IA-5

CSCv6|5.3

CSCv6|18.9

CSCv7|4.2

4.2 Ensure All Sample Data And Users Have Been Removed

4.3 Ensure 'DBA_USERS.AUTHENTICATION_TYPE' Is Not Set to 'EXTERNAL' for Any User

4.4 Ensure No Users Are Assigned the 'DEFAULT' Profile

800-53|AC-2(9)

CSCv7|4.3

4.5 Ensure 'SYS.USER$MIG' Has Been Dropped

CSCv6|16.14

CSCv7|16.4

4.6 Ensure No Public Database Links Exist

5.1.1.1 Ensure 'EXECUTE' is revoked from 'PUBLIC' on 'Network' Packages

CSCv6|5.1

5.1.1.2 Ensure 'EXECUTE' is revoked from 'PUBLIC' on 'File System' Packages

5.1.1.3 Ensure 'EXECUTE' is revoked from 'PUBLIC' on 'Encryption' Packages

5.1.1.4 Ensure 'EXECUTE' is revoked from 'PUBLIC' on 'Java' Packages

5.1.1.5 Ensure 'EXECUTE' is revoked from 'PUBLIC' on 'Job Scheduler' Packages

5.1.1.6 Ensure 'EXECUTE' is revoked from 'PUBLIC' on 'SQL Injection Helper' Packages

5.1.2.1 Ensure 'EXECUTE' is not granted to 'PUBLIC' on 'Non-default' Packages

5.1.3.1 Ensure 'ALL' Is Revoked from Unauthorized 'GRANTEE' on 'AUD$'

5.1.3.2 Ensure 'ALL' Is Revoked from Unauthorized 'GRANTEE' on 'DBA_%'

5.1.3.3 Ensure 'ALL' Is Revoked on 'Sensitive' Tables

5.2.1 Ensure '%ANY%' Is Revoked from Unauthorized 'GRANTEE'

5.2.2 Ensure 'DBA_SYS_PRIVS.%' Is Revoked from Unauthorized 'GRANTEE' with 'ADMIN_OPTION' Set to 'YES'

5.2.3 Ensure 'EXECUTE ANY PROCEDURE' Is Revoked from 'OUTLN'

5.2.4 Ensure 'EXECUTE ANY PROCEDURE' Is Revoked from 'DBSNMP'

5.2.5 Ensure 'SELECT ANY DICTIONARY' Is Revoked from Unauthorized 'GRANTEE'

5.2.6 Ensure 'SELECT ANY TABLE' Is Revoked from Unauthorized 'GRANTEE'

5.2.7 Ensure 'AUDIT SYSTEM' Is Revoked from Unauthorized 'GRANTEE'

5.2.8 Ensure 'EXEMPT ACCESS POLICY' Is Revoked from Unauthorized 'GRANTEE'

5.2.9 Ensure 'BECOME USER' Is Revoked from Unauthorized 'GRANTEE'

5.2.10 Ensure 'CREATE PROCEDURE' Is Revoked from Unauthorized 'GRANTEE'

5.2.11 Ensure 'ALTER SYSTEM' Is Revoked from Unauthorized 'GRANTEE'

5.2.12 Ensure 'CREATE ANY LIBRARY' Is Revoked from Unauthorized 'GRANTEE'

5.2.13 Ensure 'CREATE LIBRARY' Is Revoked from Unauthorized 'GRANTEE'

5.2.14 Ensure 'GRANT ANY OBJECT PRIVILEGE' Is Revoked from Unauthorized 'GRANTEE'

5.2.15 Ensure 'GRANT ANY ROLE' Is Revoked from Unauthorized 'GRANTEE'

5.2.16 Ensure 'GRANT ANY PRIVILEGE' Is Revoked from Unauthorized 'GRANTEE'

5.3.1 Ensure 'DELETE_CATALOG_ROLE' Is Revoked from Unauthorized 'GRANTEE'

5.3.2 Ensure 'SELECT_CATALOG_ROLE' Is Revoked from Unauthorized 'GRANTEE'

5.3.3 Ensure 'EXECUTE_CATALOG_ROLE' Is Revoked from Unauthorized 'GRANTEE'

5.3.4 Ensure 'DBA' Is Revoked from Unauthorized 'GRANTEE'

6.1.1 Ensure the 'USER' Audit Option Is Enabled

6.1.2 Ensure the 'ROLE' Audit Option Is Enabled

6.1.3 Ensure the 'SYSTEM GRANT' Audit Option Is Enabled

6.1.4 Ensure the 'PROFILE' Audit Option Is Enabled

6.1.5 Ensure the 'DATABASE LINK' Audit Option Is Enabled

6.1.6 Ensure the 'PUBLIC DATABASE LINK' Audit Option Is Enabled

6.1.7 Ensure the 'PUBLIC SYNONYM' Audit Option Is Enabled

6.1.8 Ensure the 'SYNONYM' Audit Option Is Enabled

6.1.9 Ensure the 'DIRECTORY' Audit Option Is Enabled

6.1.10 Ensure the 'SELECT ANY DICTIONARY' Audit Option Is Enabled

6.1.11 Ensure the 'GRANT ANY OBJECT PRIVILEGE' Audit Option Is Enabled

6.1.12 Ensure the 'GRANT ANY PRIVILEGE' Audit Option Is Enabled

6.1.13 Ensure the 'DROP ANY PROCEDURE' Audit Option Is Enabled

6.1.14 Ensure the 'ALL' Audit Option on 'SYS.AUD$' Is Enabled

6.1.15 Ensure the 'PROCEDURE' Audit Option Is Enabled

6.1.16 Ensure the 'ALTER SYSTEM' Audit Option Is Enabled

6.1.17 Ensure the 'TRIGGER' Audit Option Is Enabled

6.1.18 Ensure the 'CREATE SESSION' Audit Option Is Enabled

Detections

Analytics

Revision 1.1

Jul 18, 2023

Functional Update

Miscellaneous