The DBMS must employ strong identification and authentication techniques when establishing non-local maintenance and diagnostic sessions.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-238472	O112-C2-016100	SV-238472r667590_rule		Medium

Description
Non-local maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. The act of managing systems and applications includes the ability to access sensitive application information, such as system configuration details, diagnostic information, user information, and potentially sensitive application data. When applications provide a remote management capability inherent to the application, the application needs to ensure the identification and authentication techniques used to remotely access the system are strong enough to protect the system. If the communication channel is not adequately protected, authentication information, application data, and configuration information could be compromised.

Description

Non-local maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network. The act of managing systems and applications includes the ability to access sensitive application information, such as system configuration details, diagnostic information, user information, and potentially sensitive application data. When applications provide a remote management capability inherent to the application, the application needs to ensure the identification and authentication techniques used to remotely access the system are strong enough to protect the system. If the communication channel is not adequately protected, authentication information, application data, and configuration information could be compromised.

STIG	Date
Oracle Database 11.2g Security Technical Implementation Guide	2021-04-05

Details

Check Text ( C-41683r667588_chk )
Review DBMS settings to determine whether strong identification and authentication techniques are required for non-local maintenance and diagnostic sessions. If strong identification and authentication techniques are not required, this is a finding.

Fix Text (F-41642r667589_fix)
Configure DBMS settings to use strong identification and authentication techniques for non-local maintenance and diagnostic sessions.