Plans and procedures for testing DBMS installations, upgrades and patches must be defined and followed prior to production implementation.

From Oracle Database 11.2g Security Technical Implementation Guide

Associated with: CCI-000366

SV-68269r1_rule Plans and procedures for testing DBMS installations, upgrades and patches must be defined and followed prior to production implementation.

Vulnerability discussion

Updates and patches to existing software have the intention of improving the security or enhancing or adding features to the product. However, it is unfortunately common that updates or patches can render production systems inoperable or even introduce serious vulnerabilities. Some updates also set security configurations back to unacceptable settings that do not meet security requirements. For these reasons, it is a good practice to test updates and patches offline before introducing them in a production environment.

Check content

Review policy and procedures documented or noted in the System Security Plan and evidence of implementation for testing DBMS installations, upgrades and patches prior to production deployment. If policy and procedures do not exist or evidence of implementation does not exist, this is a Finding.

Fix text

Develop, document and implement procedures for testing DBMS installations, upgrades and patches prior to deployment on production systems.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.