Remote DBMS administration must be documented and authorized or disabled.

From Oracle Database 12c Security Technical Implementation Guide

Associated with: CCI-000366

SV-76013r3_rule Remote DBMS administration must be documented and authorized or disabled.

Vulnerability discussion

Remote administration may expose configuration and sensitive data to unauthorized viewing during transit across the network or allow unauthorized administrative access to the DBMS to remote users.For the purposes of this STIG, "Remote" means "outside the DoDIN." However, use of an approved and properly configured VPN counts as inside the DoDIN.

Check content

Review the System Security Plan for authorization, assignments and usage procedures for remote DBMS administration. If remote administration of the DBMS is not documented or poorly documented, this is a finding. If remote administration of the DBMS is not authorized and not disabled, this is a finding. If remote administration is to be performed from outside the DoDIN, but is not done via an approved and properly configured VPN, this is a finding.

Fix text

Disable remote administration of the DBMS where not required. Where remote administration of the DBMS is required, develop, document and implement policy and procedures on its use. Assign remote administration privileges to ISSO-authorized personnel only. Document assignments in the System Security Plan. Where remote administration is to be performed from outside the DoDIN, configure an approved VPN client for this purpose.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.