The DBMS must employ strong identification and authentication techniques when establishing nonlocal maintenance and diagnostic sessions.

From Oracle Database 12c Security Technical Implementation Guide

Part of SRG-APP-000185-DB-000116

Associated with: CCI-000877

SV-76241r1_rule The DBMS must employ strong identification and authentication techniques when establishing nonlocal maintenance and diagnostic sessions.

Vulnerability discussion

Non-local maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the Internet) or an internal network.The act of managing systems and applications includes the ability to access sensitive application information, such as system configuration details, diagnostic information, user information, and potentially sensitive application data.When applications provide a remote management capability inherent to the application, the application needs to ensure the identification and authentication techniques used to remotely access the system are strong enough to protect the system. If the communication channel is not adequately protected, authentication information, application data, and configuration information could be compromised.

Check content

Review DBMS settings to determine whether strong identification and authentication techniques are required for nonlocal maintenance and diagnostic sessions. If strong identification and authentication techniques are not required, this is a finding.

Fix text

Configure DBMS settings to use strong identification and authentication techniques for nonlocal maintenance and diagnostic sessions.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer