Detections
Analytics

6.3.1 Ensure 'CDB_SCHEMA_PRIVS' Does Not Have Unauthorized Privileges

Information

In Oracle 23ai, the new Schema Privileges provide fine-grained control over which users can create objects in a particular schema without requiring extensive system privileges such as CREATE ANY TABLE This improves security by allowing administrators to specifically grant CREATE ALTER DROP and SELECT privileges at the schema level instead of granting global access.

The use of Schema privileges improves security by simplifying authorization for database objects, especially for schemas that frequently add new objects. Instead of granting broad system-level ( * ANY ) privileges that apply to the entire database, privileges can now be granted at the individual schema level.

Schema privileges may inadvertently grant a technical database user excessive rights, potentially violating the principle of least privilege.

Solution

To remediate this recommendation, revoke privileges that are no longer required by executing the following SQL statement.

REVOKE <SCHEMA_PRIVILEGE> ON SCHEMA <USERNAME> FROM <GRANTEE>;

See Also

https://workbench.cisecurity.org/benchmarks/21740

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: OracleDB

Control ID: b9d33fdd139e2c6dbf1490f35a398d1221ca3148dc4336b8c4afa791b693effa