O19C-00-000100 - Oracle Database must limit the number of concurrent sessions for each system account to an organization-defined number of sessions.

CAT|II

CCI|CCI-000054

Rule-ID|SV-270495r1115953_rule

STIG-ID|O19C-00-000100

Vuln-ID|V-270495

O19C-00-000300 - Oracle Database must automatically terminate a user session after organization-defined conditions or trigger events requiring session disconnect.

CCI|CCI-002361

CCI|CCI-002363

Rule-ID|SV-270497r1064769_rule

STIG-ID|O19C-00-000300

Vuln-ID|V-270497

O19C-00-000500 - Oracle Database must associate organization-defined types of security labels having organization-defined security label values with information in storage.

CCI|CCI-002262

CCI|CCI-002263

CCI|CCI-002264

Rule-ID|SV-270498r1064772_rule

STIG-ID|O19C-00-000500

Vuln-ID|V-270498

O19C-00-000800 - Oracle Database must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

CAT|I

CCI|CCI-000015

Rule-ID|SV-270499r1064775_rule

STIG-ID|O19C-00-000800

Vuln-ID|V-270499

O19C-00-001000 - Oracle Database must enforce approved authorizations for logical access to the system in accordance with applicable policy.

CCI|CCI-000213

CCI|CCI-002235

Rule-ID|SV-270500r1064778_rule

STIG-ID|O19C-00-001000

Vuln-ID|V-270500

O19C-00-001700 - Oracle Database must protect against an individual who uses a shared account falsely denying having performed a particular action.

CAT|III

CCI|CCI-000166

CCI|CCI-004045

Rule-ID|SV-270501r1064781_rule

STIG-ID|O19C-00-001700

Vuln-ID|V-270501

O19C-00-001800 - Oracle Database must provide audit record generation capability for organization-defined auditable events within the database.

CCI|CCI-000169

Rule-ID|SV-270502r1064784_rule

STIG-ID|O19C-00-001800

Vuln-ID|V-270502

O19C-00-001900 - Oracle Database must allow designated organizational personnel to select which auditable events are to be audited by the database.

CCI|CCI-000171

Rule-ID|SV-270503r1064787_rule

STIG-ID|O19C-00-001900

Vuln-ID|V-270503

O19C-00-002000 - Oracle Database must generate audit records for the DOD-selected list of auditable events, when successfully accessed, added, modified, or deleted, to the extent such information is available.

CCI|CCI-000172

Rule-ID|SV-270504r1068292_rule

STIG-ID|O19C-00-002000

Vuln-ID|V-270504

O19C-00-005600 - Oracle Database must include organization-defined additional, more detailed information in the audit records for audit events identified by type, location, or subject.

CCI|CCI-000135

Rule-ID|SV-270505r1064793_rule

STIG-ID|O19C-00-005600

Vuln-ID|V-270505

O19C-00-005700 - Oracle Database must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.

CCI|CCI-001849

Rule-ID|SV-270506r1064796_rule

STIG-ID|O19C-00-005700

Vuln-ID|V-270506

O19C-00-005800 - Oracle Database must off-load audit data to a separate log management facility; this must be continuous and in near-real-time for systems with a network connection to the storage facility, and weekly or more often for stand-alone systems.

CCI|CCI-001851

Rule-ID|SV-270507r1065200_rule

STIG-ID|O19C-00-005800

Vuln-ID|V-270507

O19C-00-005900 - The Oracle Database, or the logging or alerting mechanism the application uses, must provide a warning when allocated audit record storage volume record storage volume reaches 75 percent of maximum audit record storage capacity.

CCI|CCI-001855

Rule-ID|SV-270508r1065201_rule

STIG-ID|O19C-00-005900

Vuln-ID|V-270508

O19C-00-006600 - The audit information produced by the Oracle Database must be protected from unauthorized access, modification, or deletion.

CCI|CCI-000162

CCI|CCI-000163

CCI|CCI-000164

Rule-ID|SV-270510r1068294_rule

STIG-ID|O19C-00-006600

Vuln-ID|V-270510

O19C-00-006900 - The system must protect audit tools from unauthorized access, modification, or deletion.

CCI|CCI-001493

CCI|CCI-001494

CCI|CCI-001495

Rule-ID|SV-270511r1065262_rule

STIG-ID|O19C-00-006900

Vuln-ID|V-270511

O19C-00-007400 - Oracle Database products must be a version supported by the vendor.

CCI|CCI-003376

Rule-ID|SV-270513r1064817_rule

STIG-ID|O19C-00-007400

Vuln-ID|V-270513

O19C-00-007700 - Database software, applications, and configuration files must be monitored to discover unauthorized changes.

CCI|CCI-001499

Rule-ID|SV-270514r1064820_rule

STIG-ID|O19C-00-007700

Vuln-ID|V-270514

O19C-00-007900 - The OS must limit privileges to change the database management system (DBMS) software resident within software libraries (including privileged programs).

Rule-ID|SV-270515r1065210_rule

STIG-ID|O19C-00-007900

Vuln-ID|V-270515

O19C-00-008000 - The Oracle Database software installation account must be restricted to authorized users.

Rule-ID|SV-270516r1064826_rule

STIG-ID|O19C-00-008000

Vuln-ID|V-270516

O19C-00-008100 - Database software directories, including database management system (DBMS) configuration files, must be stored in dedicated directories, or DASD pools, separate from the host OS and other applications.

Rule-ID|SV-270517r1064829_rule

STIG-ID|O19C-00-008100

Vuln-ID|V-270517

O19C-00-008200 - Database objects must be owned by accounts authorized for ownership.

Rule-ID|SV-270518r1064832_rule

STIG-ID|O19C-00-008200

Vuln-ID|V-270518

O19C-00-008300 - The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the DBMS, etc.) must be restricted to authorized users.

Rule-ID|SV-270519r1112463_rule

STIG-ID|O19C-00-008300

Vuln-ID|V-270519

O19C-00-008400 - Oracle Database must be configured in accordance with the security configuration settings based on DOD security configuration and implementation guidance, including STIGs, NSA configuration guides, CTOs, DTMs, and IAVMs.

CCI|CCI-000366

Rule-ID|SV-270520r1115964_rule

STIG-ID|O19C-00-008400

Vuln-ID|V-270520

O19C-00-008600 - Oracle instance names must not contain Oracle version numbers.

Rule-ID|SV-270521r1112467_rule

STIG-ID|O19C-00-008600

Vuln-ID|V-270521

O19C-00-008700 - Fixed user and PUBLIC Database links must be authorized for use.

Rule-ID|SV-270522r1115956_rule

STIG-ID|O19C-00-008700

Vuln-ID|V-270522

O19C-00-009000 - The Oracle WITH GRANT OPTION privilege must not be granted to nondatabase administrator (DBA) or nonapplication administrator user accounts.

Rule-ID|SV-270523r1065302_rule

STIG-ID|O19C-00-009000

Vuln-ID|V-270523

O19C-00-009200 - The Oracle REMOTE_OS_ROLES parameter must be set to FALSE.

Rule-ID|SV-270524r1112471_rule

STIG-ID|O19C-00-009200

Vuln-ID|V-270524

O19C-00-009300 - The Oracle SQL92_SECURITY parameter must be set to TRUE.

Rule-ID|SV-270525r1112473_rule

STIG-ID|O19C-00-009300

Vuln-ID|V-270525

O19C-00-009400 - The Oracle password file ownership and permissions should be limited and the REMOTE_LOGIN_PASSWORDFILE parameter must be set to EXCLUSIVE or NONE.

Rule-ID|SV-270526r1115966_rule

STIG-ID|O19C-00-009400

Vuln-ID|V-270526

O19C-00-009500 - System privileges granted using the WITH ADMIN OPTION must not be granted to unauthorized user accounts.

Rule-ID|SV-270527r1065266_rule

STIG-ID|O19C-00-009500

Vuln-ID|V-270527

O19C-00-009600 - System Privileges must not be granted to PUBLIC.

Rule-ID|SV-270528r1064862_rule

STIG-ID|O19C-00-009600

Vuln-ID|V-270528

O19C-00-009700 - Oracle roles granted using the WITH ADMIN OPTION must not be granted to unauthorized accounts.

Rule-ID|SV-270529r1065268_rule

STIG-ID|O19C-00-009700

Vuln-ID|V-270529

O19C-00-009800 - Object permissions granted to PUBLIC must be restricted.

Rule-ID|SV-270530r1065320_rule

STIG-ID|O19C-00-009800

Vuln-ID|V-270530

O19C-00-010000 - Application role permissions must not be assigned to the Oracle PUBLIC role.

Rule-ID|SV-270532r1064874_rule

STIG-ID|O19C-00-010000

Vuln-ID|V-270532

O19C-00-010100 - Oracle application administration roles must be disabled if not required and authorized.

Rule-ID|SV-270533r1065215_rule

STIG-ID|O19C-00-010100

Vuln-ID|V-270533

O19C-00-010400 - The directories assigned to the LOG_ARCHIVE_DEST* parameters must be protected from unauthorized access.

Rule-ID|SV-270534r1065274_rule

STIG-ID|O19C-00-010400

Vuln-ID|V-270534

O19C-00-010500 - The Oracle _TRACE_FILES_PUBLIC parameter if present must be set to FALSE.

Rule-ID|SV-270535r1065307_rule

STIG-ID|O19C-00-010500

Vuln-ID|V-270535

O19C-00-010600 - Oracle Database production application and data directories must be protected from developers on shared production/development database management system (DBMS) host systems.

Rule-ID|SV-270536r1064886_rule

STIG-ID|O19C-00-010600

Vuln-ID|V-270536

O19C-00-010700 - Use of the Oracle Database installation account must be logged.

Rule-ID|SV-270537r1064889_rule

STIG-ID|O19C-00-010700

Vuln-ID|V-270537

O19C-00-010800 - The Oracle Database data files, transaction logs and audit files must be stored in dedicated directories or disk partitions separate from software or other application files.

Rule-ID|SV-270538r1064892_rule

STIG-ID|O19C-00-010800

Vuln-ID|V-270538

O19C-00-011300 - Changes to configuration options must be audited.

Rule-ID|SV-270540r1064898_rule

STIG-ID|O19C-00-011300

Vuln-ID|V-270540

O19C-00-011500 - The /diag subdirectory under the directory assigned to the DIAGNOSTIC_DEST parameter must be protected from unauthorized access.

Rule-ID|SV-270541r1065276_rule

STIG-ID|O19C-00-011500

Vuln-ID|V-270541

O19C-00-011900 - Oracle Database default accounts must be assigned custom passwords.

Detections

Analytics

DISA Oracle Database 19c STIG v1r2 OracleDB

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous