The DBMS must use organization defined replay-resistant authentication mechanisms for network access to privileged accounts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-32450	SRG-APP-000156-DB-000111	SV-42787r1_rule		Medium

Description
An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. Techniques used to address this include protocols using nonce's (e.g., numbers generated for a specific one time use) or challenges (e.g., TLS, WS_Security), and time synchronous or challenge-response one-time authenticators. Replay attacks, if successfully used against a database account could result in unfettered access to the database settings and data. A successful replay attack against a privileged database account could result in a complete compromise of the database.

Description

An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. Techniques used to address this include protocols using nonce's (e.g., numbers generated for a specific one time use) or challenges (e.g., TLS, WS_Security), and time synchronous or challenge-response one-time authenticators. Replay attacks, if successfully used against a database account could result in unfettered access to the database settings and data. A successful replay attack against a privileged database account could result in a complete compromise of the database.

STIG	Date
Database Security Requirements Guide	2012-07-02

Details

Check Text ( C-40889r1_chk )
Review DBMS settings to determine whether organization defined replay-resistant authentication mechanisms for network access to privileged accounts exist. If these mechanisms do not exist, this is a finding.

Fix Text (F-36365r1_fix)
Configure the DBMS to utilize replay resistant authentication mechanisms such as nonce's (e.g., numbers generated for a specific one time use) or challenges (e.g., TLS, WS_Security), and time synchronous or challenge-response one-time authenticators.