Detections
Analytics

PGS9-00-003000 - PostgreSQL must maintain the confidentiality and integrity of information during reception.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Information can be either unintentionally or maliciously disclosed or modified during reception, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information.

This requirement applies only to those applications that are either distributed or can allow access to data nonlocally. Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process.

When receiving data, PostgreSQL, associated applications, and infrastructure must leverage protection mechanisms.

For more information on configuring PostgreSQL to use SSL, consult the following documentation:
https://www.postgresql.org/docs/current/ssl-tcp.html

Postgres provides native support for using SSL connections to encrypt client/server communications. To enable the use of SSL, the postgres 'ssl' configuration parameter must be set to 'on' and the database instance needs to be configured to use a valid server certificate and private key installed on the server. With SSL enabled, connections made to the database server will default to being encrypted. However, it is possible for clients to override the default and attempt to establish an unencrypted connection. To prevent connections made from non-local hosts from being unencrypted, the postgres host-based authentication settings should be configured to only allow hostssl (i.e., encrypted) connections. The hostssl connections can be further configured to require that the client present a valid (trusted) SSL certificate for a connection.

Solution

Implement protective measures against unauthorized disclosure and modification during reception.

To configure PostgreSQL to use SSL, see supplementary content APPENDIX-G for instructions on enabling SSL.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_PGS_SQL_9-x_V2R2_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-13, CAT|II, CCI|CCI-002422, Rule-ID|SV-214073r548754_rule, STIG-ID|PGS9-00-003000, STIG-Legacy|SV-87547, STIG-Legacy|V-72895, Vuln-ID|V-214073

Plugin: Unix

Control ID: 97f962eaa88444398daae230b214de83d734493cb37bf6e5ede2e1a5dcee9ca7