OpenControls Logo

STIG Viewer

STIGViewer Support

Redis Enterprise DBMS must fail to a secure state if system initialization fails, shutdown fails, or aborts fail.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-251240RD6X-00-010600SV-251240r961122_ruleCCI-001190medium
Description
Failure to a known state can address safety or security in accordance with the mission/business needs of the organization. Databases must fail to a known consistent state. Transactions must be successfully completed or rolled back. All data is stored and managed exclusively in either RAM or RAM + Flash Memory (Redis on Flash) and therefore, is at risk of being lost upon a process or server failure. As Redis Enterprise Software is not just a caching solution, but also a full-fledged database, persistence to disk is critical. Therefore, Redis Enterprise Software supports persisting data to disk on a per-database basis. Append Only File (AOF) is a continuous writing of data to disk Snapshot. It is not a replacement for backups but should be done in addition to backups. AOF writes the latest "write" commands into a file either every second or during every write. It resembles a traditional RDBMS's redo log. This file can later be replayed to recover from a crash. To ensure data availability, Redis Enterprise Software must be implemented in, at a minimum, a three-node cluster. A three-node cluster can withstand one node failure without data loss. If more than one node is lost in a three-node cluster and persistence is not enabled, then data loss is to be expected. The Append Only File is a persistence mode that provides much better durability. For instance, using the default data fsync policy, Redis can lose just one second of writes in a dramatic event like a server power outage, or a single write if something goes wrong with the Redis process itself, but the operating system is still running correctly. AOF and RDB persistence can be enabled at the same time without problems. If the AOF is enabled on startup Redis will load the AOF, that is the file with the better durability guarantees. Check http://redis.io/topics/persistence for more information. Redis Labs additionally recommends using the wait command. Review the wait command at: https://redis.io/commands/wait and determine if this meets organizational needs.
STIGDate
Redis Enterprise 6.x Security Technical Implementation Guide2024-09-04

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (9) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

BCD-01Business Continuity Management System (BCMS)
1.00
CFG-02Secure Baseline Configurations
1.00
CRY-01Use of Cryptographic Controls
1.00
DCH-01Data Protection
1.00
IAC-21Least Privilege
1.00
SEA-01Secure Engineering Principles
1.00
SEA-01.2Achieving Resilience Requirements
1.00
SEA-02Alignment With Enterprise Architecture
1.00
SEA-07.2Fail Secure
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (7) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AU-3(2)Centralized Management of Planned Audit Record Content
1.00
AU-5Response to Audit Logging Process Failures
1.00
SC-24Fail in Known State
1.00
SC-5Denial-of-service Protection
1.00
SC-7Boundary Protection
1.00
SC-7(11)Restrict Incoming Communications Traffic
1.00
SC-7(5)Deny by Default — Allow by Exception
1.00
CCI1 mapping
CCI-001190
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (2) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.DS-10
1.00
PR.IR-03
1.00

Who does this work

13 NICE work roles and 8 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-251240r961122_chk)

1. In the console UI, click the databases tab. 2. For each listed database, click it and select configuration. 3. Verify that "Persistence" is set to: "Append Only File (AOF) - fsync every write". If the setting is not configured or not documented to be set differently, this is a finding. 4. For each listed database, click it and select configuration. 5. Verify "Replication" is set enabled. If the setting is not configured or not documented to be set differently, this is a finding.

Fix Text (F-54629r804909_fix)

To enable persistence and replication in the Redis Enterprise UI, click the databases tab. For each database that requires reconfiguration, click it and select configuration. Ensure that the replication box is checked as well as the desired persistence level. Edit the parameters necessary to meet the desired organizational needs.