Procedures for establishing temporary passwords that meet DoD password requirements for new accounts should be defined, documented and implemented.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-3811	DG0066-ORACLE11	SV-24639r1_rule		Medium

Description
New accounts authenticated by passwords that are created without a password or with an easily guessed password are vulnerable to unauthorized access. Procedures for creating new accounts with passwords should include the required assignment of a temporary password to be modified by the user upon first use.

STIG	Date
Oracle Database 11g Installation STIG	2016-06-15

Details

Check Text ( C-29163r1_chk )
If all database accounts are configured to authenticate using certificates or other credentials besides passwords, this check is Not a Finding. Review documented procedures and evidence of implementation for assignment of temporary passwords for password-authenticated accounts. Confirm temporary passwords meet DoD password requirements. Review documented procedures for distribution of temporary passwords to users. Have the DBA demonstrate that the DBMS or applications accessing the database are configured to require a change of password by the user upon first use. If documented procedures and evidence do not exist or are not complete, temporary passwords do not meet DoD password requirements, or the DBMS or applications accessing the database are not configured to require a change of password by the user upon first use, this is a Finding.

Check Text ( C-29163r1_chk )

If all database accounts are configured to authenticate using certificates or other credentials besides passwords, this check is Not a Finding.

Review documented procedures and evidence of implementation for assignment of temporary passwords for password-authenticated accounts.

Confirm temporary passwords meet DoD password requirements.

Review documented procedures for distribution of temporary passwords to users.

Have the DBA demonstrate that the DBMS or applications accessing the database are configured to require a change of password by the user upon first use.

If documented procedures and evidence do not exist or are not complete, temporary passwords do not meet DoD password requirements, or the DBMS or applications accessing the database are not configured to require a change of password by the user upon first use, this is a Finding.

Fix Text (F-26175r1_fix)
Develop, document and implement procedures for assigning, distributing and changing of temporary passwords for new database user accounts. Procedures should include instruction that meet current DoD password length and complexity requirements and provide a secure method to relay the temporary password to the user. Temporary passwords should also be short-lived and require immediate update by the user upon first use. Consider using account authentication using certificates or other credentials in place of password authentication.

Fix Text (F-26175r1_fix)

Develop, document and implement procedures for assigning, distributing and changing of temporary passwords for new database user accounts.

Procedures should include instruction that meet current DoD password length and complexity requirements and provide a secure method to relay the temporary password to the user.

Temporary passwords should also be short-lived and require immediate update by the user upon first use.

Consider using account authentication using certificates or other credentials in place of password authentication.