The DBMS must restrict grants to sensitive information to authorized user roles.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-238439	O112-C2-003500	SV-238439r667491_rule		Medium

Description
Applications employ the concept of least privilege for specific duties and information systems (including specific functions, ports, protocols, and services). The concept of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of information systems. Unauthorized access to sensitive data may compromise the confidentiality of personnel privacy, threaten national security, or compromise a variety of other sensitive operations. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.

Description

Applications employ the concept of least privilege for specific duties and information systems (including specific functions, ports, protocols, and services). The concept of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions and/or functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary to achieve least privilege. Organizations also apply least privilege concepts to the design, development, implementation, and operations of information systems. Unauthorized access to sensitive data may compromise the confidentiality of personnel privacy, threaten national security, or compromise a variety of other sensitive operations. Access controls are best managed by defining requirements based on distinct job functions and assigning access based on the job function assigned to the individual user.

STIG	Date
Oracle Database 11.2g Security Technical Implementation Guide	2021-04-05

Details

Check Text ( C-41650r667489_chk )
Obtain a list of privileges assigned to user accounts. If access to sensitive information is granted to roles not authorized to access sensitive information, this is a finding. If access to sensitive information is granted to individual accounts rather than to a role, this is a finding.

Fix Text (F-41609r667490_fix)
Define application user roles based on privilege and job function requirements. Assign the required privileges to the role and assign the role to authorized application user accounts. Revoke any privileges to sensitive information directly assigned to application user accounts.