OpenControls Logo

STIG Viewer

STIGViewer Support

The MySQL Database Server 8.0 must generate audit records when unsuccessful attempts to execute privileged activities or other system-level access occur.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-235128MYS8-00-004100SV-235128r961827_ruleCCI-000172medium
Description
Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. System documentation should include a definition of the functionality considered privileged. A privileged function in this context is any operation that modifies the structure of the database, its built-in logic, or its security settings. This would include all Data Definition Language (DDL) statements and all security-related statements. In an SQL environment, it encompasses, but is not necessarily limited to: CREATE ALTER DROP GRANT REVOKE DENY Note that it is particularly important to audit, and tightly control, any action that weakens the implementation of this requirement itself, since the objective is to have a complete audit trail of all administrative activity. To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.
STIGDate
Oracle MySQL 8.0 Security Technical Implementation Guide2024-09-04

Related Frameworks

1 mapping across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (15) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

END-01Endpoint Device Management (EDM)
1.00
END-04Malicious Code Protection (Anti-Malware)
1.00
END-06Endpoint File Integrity Monitoring (FIM)
1.00
MON-01Continuous Monitoring
1.00
MON-01.1Intrusion Detection & Prevention Systems (IDS & IPS)
1.00
MON-01.3Inbound & Outbound Communications Traffic
1.00
MON-01.4System Generated Alerts
1.00
MON-01.7File Integrity Monitoring (FIM)
1.00
MON-01.8Security Event Monitoring
1.00
MON-03Content of Event Logs
1.00

+5 more (top 10 by confidence shown)

NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (80) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-12Session Termination
1.00
AC-16Security and Privacy Attributes
1.00
AC-17(1)Monitoring and Control
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00
AC-3Access Enforcement
1.00

+70 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.3.1
1.00
3.3.2
1.00
CCI1 mapping
CCI-000172
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (4) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

DE.CM-01
1.00
DE.CM-03
1.00
DE.CM-09
1.00
PR.PS-04
1.00

Who does this work

12 NICE work roles and 9 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-235128r961827_chk)

Review the system documentation to determine if MySQL Server is required to audit for unsuccessful attempts to execute privileged activities or other system-level access. Check if MySQL audit is configured and enabled. The my.cnf file will set the variable audit_file. To further check, execute the following query: SELECT PLUGIN_NAME, PLUGIN_STATUS FROM INFORMATION_SCHEMA.PLUGINS WHERE PLUGIN_NAME LIKE 'audit%'; The status of the audit_log plugin must be "active". If it is not "active", this is a finding. Review audit filters and associated users by running the following queries: SELECT `audit_log_filter`.`NAME`, `audit_log_filter`.`FILTER` FROM `mysql`.`audit_log_filter`; SELECT `audit_log_user`.`USER`, `audit_log_user`.`HOST`, `audit_log_user`.`FILTERNAME` FROM `mysql`.`audit_log_user`; All currently defined audits for the MySQL server instance will be listed. If no audits are returned, this is a finding. Determine if rules are in place to capture the following types of commands related to permissions by running: select * from mysql.audit_log_filter; If the template SQL filter was used, it will have the name log_stig. Review the filter values it will show filters for events of type of the field general_sql_command.str for the following SQL statement types: grant grant_roles revoke revoke_all revoke_roles drop_role alter_user_default_role create_role drop_role grant_roles revoke_roles set_role create_user alter_user drop_user alter_user alter_user_default_role create_user drop_user rename_user show_create_user

Fix Text (F-38310r623505_fix)

Configure the MySQL Database Server to audit for unsuccessful attempts to execute privileged activities or other system-level access. Add the following events to the MySQL Server Audit: grant grant_roles revoke revoke_all revoke_roles drop_role alter_user_default_role create_role drop_role grant_roles revoke_roles set_role create_user alter_user drop_user alter_user alter_user_default_role create_user drop_user rename_user show_create_user See the supplemental file "MySQL80Audit.sql".