EDB PostgreSQL Advanced Server v11 Windows OS Audit v2r1

Warning! Audit Deprecated

This audit file has been deprecated and will be removed in a future update.

View Next Version

Audit Details

Name: EDB PostgreSQL Advanced Server v11 Windows OS Audit v2r1

Updated: 2/6/2023

Authority: Operating Systems and Applications

Plugin: Windows

Revision: 1.5

Estimated Item Count: 40

File Details

Filename: DISA_STIG_EDB_PostgreSQL_Advanced_Server_v11_Windows_v2r1_OS.audit

Size: 129 kB

MD5: f3f1e5b0fabd12f1c1205912c53bfb9f
SHA256: e7125cec83f906d5ac6e1e51ebd768312122f0df2027b4175f934d4646185d5c

Audit Items

DescriptionCategories
EP11-00-000700 - The EDB Postgres Advanced Server must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

ACCESS CONTROL

EP11-00-001100 - The EDB Postgres Advanced Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - data dir

CONFIGURATION MANAGEMENT

EP11-00-001100 - The EDB Postgres Advanced Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - data\*

CONFIGURATION MANAGEMENT

EP11-00-001100 - The EDB Postgres Advanced Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - postgresql.conf

CONFIGURATION MANAGEMENT

EP11-00-002300 - The EDB Postgres Advanced Server must by default shut down upon audit failure, to include the unavailability of space for more audit log records; or must be configurable to shut down upon audit failure.
EP11-00-002400 - The EDB Postgres Advanced Server must be configurable to overwrite audit log records, oldest first (First-In-First-Out - FIFO), in the event of unavailability of space for more audit log records.
EP11-00-002600 - The audit information produced by the EDB Postgres Advanced Server must be protected from unauthorized read access.

CONFIGURATION MANAGEMENT

EP11-00-002700 - The audit information produced by the EDB Postgres Advanced Server must be protected from unauthorized modification.

CONFIGURATION MANAGEMENT

EP11-00-002800 - The audit information produced by the EDB Postgres Advanced Server must be protected from unauthorized deletion.

CONFIGURATION MANAGEMENT

EP11-00-002900 - The EDB Postgres Advanced Server must protect its audit features from unauthorized access.

CONFIGURATION MANAGEMENT

EP11-00-003000 - The EDB Postgres Advanced Server must protect its audit configuration from unauthorized modification.

CONFIGURATION MANAGEMENT

EP11-00-003100 - The EDB Postgres Advanced Server must protect its audit features from unauthorized removal.

CONFIGURATION MANAGEMENT

EP11-00-003200 - Software, applications, and configuration files that are part of, or related to, the Postgres Plus Advanced Server installation must be monitored to discover unauthorized changes.
EP11-00-003400 - Database software, including EDB Postgres Advanced Server configuration files, must be stored in dedicated directories, separate from the host OS and other applications.
EP11-00-003600 - The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the EDB Postgres Advanced Server, etc.) must be restricted to authorized users.
EP11-00-003800 - Unused database components, EDB Postgres Advanced Server software, and database objects must be removed.
EP11-00-003900 - Unused database components which are integrated in the EDB Postgres Advanced Server and cannot be uninstalled must be disabled.

CONFIGURATION MANAGEMENT

EP11-00-004000 - Access to external executables must be disabled or restricted.

CONFIGURATION MANAGEMENT

EP11-00-004200 - The EDB Postgres Advanced Server must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

ACCESS CONTROL

EP11-00-004400 - If passwords are used for authentication, the EDB Postgres Advanced Server must transmit only encrypted representations of passwords.

CONFIGURATION MANAGEMENT

EP11-00-004500 - The EDB Postgres Advanced Server, when utilizing PKI-based authentication, must validate certificates by performing RFC 5280-compliant certification path validation.

SYSTEM AND COMMUNICATIONS PROTECTION

EP11-00-004600 - The EDB Postgres Advanced Server must enforce authorized access to all PKI private keys stored/utilized by the EDB Postgres Advanced Server.

CONFIGURATION MANAGEMENT

EP11-00-004850 - The EDB Postgres Advanced Server password file must not be used.

CONFIGURATION MANAGEMENT

EP11-00-004900 - The EDB Postgres Advanced Server must use NIST FIPS 140-2 validated cryptographic modules for all cryptographic operations including generation of cryptographic hashes and data protection - hostssl

CONFIGURATION MANAGEMENT

EP11-00-004900 - The EDB Postgres Advanced Server must use NIST FIPS 140-2 validated cryptographic modules for all cryptographic operations including generation of cryptographic hashes and data protection - openssl_conf

CONFIGURATION MANAGEMENT

EP11-00-005700 - The EDB Postgres Advanced Server must protect the confidentiality and integrity of all information at rest.
EP11-00-006100 - Access to database files must be limited to relevant processes and to authorized, administrative users.

CONFIGURATION MANAGEMENT

EP11-00-008000 - The EDB Postgres Advanced Server must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75% of maximum audit record storage capacity.
EP11-00-008400 - The EDB Postgres Advanced Server must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status.
EP11-00-008500 - The EDB Postgres Advanced Server must enforce access restrictions associated with changes to the configuration of the EDB Postgres Advanced Server or database(s).
EP11-00-008700 - The EDB Postgres Advanced Server must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.

SYSTEM AND COMMUNICATIONS PROTECTION

EP11-00-009100 - The EDB Postgres Advanced Server must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs) for the establishment of all encrypted sessions.

SYSTEM AND COMMUNICATIONS PROTECTION

EP11-00-009200 - The EDB Postgres Advanced Server must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.
EP11-00-009300 - The EDB Postgres Advanced Server must implement cryptographic mechanisms preventing the unauthorized disclosure of organization-defined information at rest on organization-defined information system components.
EP11-00-009500 - The EDB Postgres Advanced Server must maintain the confidentiality and integrity of information during preparation for transmission.

SYSTEM AND COMMUNICATIONS PROTECTION

EP11-00-009600 - The EDB Postgres Advanced Server must maintain the confidentiality and integrity of information during reception.

SYSTEM AND COMMUNICATIONS PROTECTION

EP11-00-012700 - The EDB Postgres Advanced Server must implement NIST FIPS 140-2 validated cryptographic modules to provision digital signatures - hostssl

CONFIGURATION MANAGEMENT

EP11-00-012700 - The EDB Postgres Advanced Server must implement NIST FIPS 140-2 validated cryptographic modules to provision digital signatures - openssl_conf

CONFIGURATION MANAGEMENT

EP11-00-013200 - The EDB Postgres Advanced Server must be configured on a platform that has a NIST certified FIPS 140-2 installation of OpenSSL - hostssl

CONFIGURATION MANAGEMENT

EP11-00-013200 - The EDB Postgres Advanced Server must be configured on a platform that has a NIST certified FIPS 140-2 installation of OpenSSL - openssl_conf

CONFIGURATION MANAGEMENT