Detections
Analytics

MYS8-00-012100 - The MySQL Database Server 8.0 must implement cryptographic mechanisms preventing the unauthorized disclosure of organization-defined information at rest on organization-defined information system components

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Database Management Systems (DBMSs) handling data requiring data-at-rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. These cryptographic mechanisms may be native to the DBMS or implemented via additional software or operating system/file system settings, as appropriate to the situation.

Selection of a cryptographic mechanism is based on the need to protect the integrity of organizational information. The strength of the mechanism is commensurate with the security category and/or classification of the information. Organizations have the flexibility to either encrypt all information on storage devices (i.e., full disk encryption) or encrypt specific data structures (e.g., files, records, or fields).

The decision whether and what to encrypt rests with the data owner and is also influenced by the physical measures taken to secure the equipment and media on which the information resides.

Solution

Configure the MySQL Database Server 8.0, operating system/file system, and additional software as relevant, to provide the required level of cryptographic protection.

Enable the MySQL Key Ring for securely managing encryption keys with KMIP or other supported protocols.

Change TABLESPACES, TABLES to put in place encryption.

ALTER TABLESPACE <tablespacename> ENCRYPTION = 'Y';
ALTER TABLE <tablespacename> ENCRYPTION = 'Y';

Require all new tables and tablespaces to be encrypted.
set persist table_encryption_privilege_check=ON;

Require AUDIT LOG encryption
sudo vi /etc/my.cnf
[mysqld]
audit-log=FORCE_PLUS_PERMANENT
audit-log-format=JSON
audit-log-encryption=AES

Require BINLOG encryption
set persist binlog_encryption=ON;

Require REDO and UNDO log encryption
set persist innodb_redo_log_encrypt=ON;
set persist innodb_undo_log_encrypt=ON;

Turn off insecure logging - (use the audit log above to track activity)
SET PERSIST general_log = 'OFF';

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_MySQL_8-0_V1R4_STIG.zip

Item Details

References: CAT|II, CCI|CCI-002476, Rule-ID|SV-235193r879800_rule, STIG-ID|MYS8-00-012100, Vuln-ID|V-235193

Plugin: MySQLDB

Control ID: ce8b8aaa3d2d44cc70c6a3a370f6f8b37a6ef978dbfa538a5f40967313431ffa