CD16-00-000100 - PostgreSQL must limit the number of concurrent sessions to an organization-defined number per user for all accounts and/or account types.

800-53|AC-10

CAT|II

CCI|CCI-000054

Rule-ID|SV-261857r1000976_rule

STIG-ID|CD16-00-000100

Vuln-ID|V-261857

CD16-00-000200 - PostgreSQL must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

800-53|AC-2(1)

CAT|I

CCI|CCI-000015

Rule-ID|SV-261858r1043176_rule

STIG-ID|CD16-00-000200

Vuln-ID|V-261858

CD16-00-000300 - PostgreSQL must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

800-53|AC-3

CCI|CCI-000213

Rule-ID|SV-261859r1137654_rule

STIG-ID|CD16-00-000300

Vuln-ID|V-261859

CD16-00-000400 - PostgreSQL must protect against a user falsely repudiating having performed organization-defined actions.

800-53|AU-10

CCI|CCI-000166

Rule-ID|SV-261860r1000977_rule

STIG-ID|CD16-00-000400

Vuln-ID|V-261860

CD16-00-000500 - PostgreSQL must provide audit record generation capability for DOD-defined auditable events within all DBMS/database components.

800-53|AU-12a.

CCI|CCI-000169

Rule-ID|SV-261861r1000588_rule

STIG-ID|CD16-00-000500

Vuln-ID|V-261861

CD16-00-000600 - PostgreSQL must allow only the information system security manager (ISSM), or individuals or roles appointed by the ISSM, to select which events are to be audited.

800-53|AU-12b.

CCI|CCI-000171

Rule-ID|SV-261862r1000591_rule

STIG-ID|CD16-00-000600

Vuln-ID|V-261862

CD16-00-000700 - PostgreSQL must be able to generate audit records when privileges/permissions are retrieved.

800-53|AU-12c.

CCI|CCI-000172

Rule-ID|SV-261863r1000954_rule

STIG-ID|CD16-00-000700

Vuln-ID|V-261863

CD16-00-000800 - PostgreSQL must generate audit records when unsuccessful attempts to retrieve privileges/permissions occur.

Rule-ID|SV-261864r1000597_rule

STIG-ID|CD16-00-000800

Vuln-ID|V-261864

CD16-00-000900 - PostgreSQL must initiate session auditing upon startup.

800-53|AU-14(1)

CCI|CCI-001464

Rule-ID|SV-261865r1000600_rule

STIG-ID|CD16-00-000900

Vuln-ID|V-261865

CD16-00-001000 - PostgreSQL must produce audit records containing sufficient information to establish what type of events occurred.

800-53|AU-3

CCI|CCI-000130

Rule-ID|SV-261866r1000603_rule

STIG-ID|CD16-00-001000

Vuln-ID|V-261866

CD16-00-001100 - PostgreSQL must produce audit records containing time stamps to establish when the events occurred.

CCI|CCI-000131

Rule-ID|SV-261867r1000955_rule

STIG-ID|CD16-00-001100

Vuln-ID|V-261867

CD16-00-001200 - PostgreSQL must produce audit records containing sufficient information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-261868r1000609_rule

STIG-ID|CD16-00-001200

Vuln-ID|V-261868

CD16-00-001300 - PostgreSQL must produce audit records containing sufficient information to establish the sources (origins) of the events.

CCI|CCI-000133

Rule-ID|SV-261869r1000956_rule

STIG-ID|CD16-00-001300

Vuln-ID|V-261869

CD16-00-001400 - PostgreSQL must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.

CCI|CCI-000134

Rule-ID|SV-261870r1000615_rule

STIG-ID|CD16-00-001400

Vuln-ID|V-261870

CD16-00-001500 - PostgreSQL must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event.

CCI|CCI-001487

Rule-ID|SV-261871r1000618_rule

STIG-ID|CD16-00-001500

Vuln-ID|V-261871

CD16-00-001600 - PostgreSQL must include additional, more detailed, organization-defined information in the audit records for audit events identified by type, location, or subject.

800-53|AU-3(1)

CCI|CCI-000135

Rule-ID|SV-261872r1000621_rule

STIG-ID|CD16-00-001600

Vuln-ID|V-261872

CD16-00-001700 - PostgreSQL must, by default, shut down upon audit failure, to include the unavailability of space for more audit log records; or must be configurable to shut down upon audit failure.

800-53|AU-5b.

CCI|CCI-000140

Rule-ID|SV-261873r1043188_rule

STIG-ID|CD16-00-001700

Vuln-ID|V-261873

CD16-00-001800 - PostgreSQL must be configurable to overwrite audit log records, oldest first (first-in-first-out [FIFO]), in the event of unavailability of space for more audit log records.

Rule-ID|SV-261874r1043188_rule

STIG-ID|CD16-00-001800

Vuln-ID|V-261874

CD16-00-002000 - The audit information produced by PostgreSQL must be protected from unauthorized read access.

800-53|AU-9

CCI|CCI-000162

Rule-ID|SV-261875r1000630_rule

STIG-ID|CD16-00-002000

Vuln-ID|V-261875

CD16-00-002300 - PostgreSQL must protect its audit features from unauthorized access.

CCI|CCI-001493

Rule-ID|SV-261878r1000958_rule

STIG-ID|CD16-00-002300

Vuln-ID|V-261878

CD16-00-002400 - PostgreSQL must protect its audit configuration from unauthorized modification.

CCI|CCI-001494

Rule-ID|SV-261879r1000960_rule

STIG-ID|CD16-00-002400

Vuln-ID|V-261879

CD16-00-003200 - Unused database components, PostgreSQL software, and database objects must be removed.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-261886r1000951_rule

STIG-ID|CD16-00-003200

Vuln-ID|V-261886

CD16-00-003400 - Access to external executables must be disabled or restricted.

Rule-ID|SV-261888r1000669_rule

STIG-ID|CD16-00-003400

Vuln-ID|V-261888

CD16-00-003500 - PostgreSQL must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.

800-53|CM-7b.

CCI|CCI-000382

Rule-ID|SV-261889r1043177_rule

STIG-ID|CD16-00-003500

Vuln-ID|V-261889

CD16-00-003800 - If passwords are used for authentication, PostgreSQL must store only hashed, salted representations of passwords.

800-53|IA-5(1)(c)

CCI|CCI-000196

Rule-ID|SV-261891r1000970_rule

STIG-ID|CD16-00-003800

Vuln-ID|V-261891

CD16-00-004000 - PostgreSQL, when using PKI-based authentication, must validate certificates by performing RFC 5280-compliant certification path validation.

800-53|IA-5(2)(a)

CCI|CCI-000185

Rule-ID|SV-261893r1000684_rule

STIG-ID|CD16-00-004000

Vuln-ID|V-261893

CD16-00-004100 - PostgreSQL must enforce authorized access to all PKI private keys stored/used by PostgreSQL.

800-53|IA-5(2)(b)

CCI|CCI-000186

Rule-ID|SV-261894r1000687_rule

STIG-ID|CD16-00-004100

Vuln-ID|V-261894

CD16-00-004500 - PostgreSQL must uniquely identify and authenticate nonorganizational users (or processes acting on behalf of nonorganizational users).

800-53|IA-8

CCI|CCI-000804

Rule-ID|SV-261897r1000696_rule

STIG-ID|CD16-00-004500

Vuln-ID|V-261897

CD16-00-004600 - PostgreSQL must separate user functionality (including user interface services) from database management functionality.

800-53|SC-2

CCI|CCI-001082

Rule-ID|SV-261898r1137655_rule

STIG-ID|CD16-00-004600

Vuln-ID|V-261898

CD16-00-004700 - PostgreSQL must invalidate session identifiers upon user logout or other session termination.

800-53|SC-23(1)

CCI|CCI-001185

Rule-ID|SV-261899r1043179_rule

STIG-ID|CD16-00-004700

Vuln-ID|V-261899

CD16-00-004900 - PostgreSQL must maintain the authenticity of communications sessions by guarding against man-in-the-middle attacks that guess at Session ID values.

800-53|SC-23(3)

CCI|CCI-001188

Rule-ID|SV-261900r1043181_rule

STIG-ID|CD16-00-004900

Vuln-ID|V-261900

CD16-00-005300 - PostgreSQL must isolate security functions from nonsecurity functions.

800-53|SC-3

CCI|CCI-001084

Rule-ID|SV-261902r1000711_rule

STIG-ID|CD16-00-005300

Vuln-ID|V-261902

CD16-00-005900 - PostgreSQL and associated applications, when making use of dynamic code execution, must scan input data for invalid values that may indicate a code injection attack.

800-53|SI-10

CCI|CCI-001310

Rule-ID|SV-261907r1000726_rule

STIG-ID|CD16-00-005900

Vuln-ID|V-261907

CD16-00-006000 - PostgreSQL must provide nonprivileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

800-53|SI-11a.

CCI|CCI-001312

Rule-ID|SV-261908r1000729_rule

STIG-ID|CD16-00-006000

Vuln-ID|V-261908

CD16-00-006100 - PostgreSQL must reveal detailed error messages only to the information system security officer (ISSO), information system security manager (ISSM), system administrator (SA), and database administrator (DBA).

800-53|SI-11b.

CCI|CCI-001314

Rule-ID|SV-261909r1000980_rule

STIG-ID|CD16-00-006100

Vuln-ID|V-261909

CD16-00-006200 - PostgreSQL must automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.

800-53|AC-12

Detections

Analytics

DISA Crunchy Data Postgres 16 STIG v1r2 PostgreSQLDB

Audit Details

File Details

Audit Changelog

No revisions found