Sensitive data should be labeled.

SV-24393r2_rule Sensitive data should be labeled.

Vulnerability discussion

The sensitivity marking or labeling of data items promotes the correct handling and protection of the data. Without such notification, the user may unwittingly disclose sensitive data to unauthorized users.

Check content

If database does not contain sensitive data, this check is Not a Finding. If Oracle Label Security is not installed and database contains sensitive data, this is a Finding. From SQL*Plus: select * from DBA_SA_USERS; Compare results to the requirements for labeling as specified in the System Security Plan. If label security is not configured as specified in the System Security Plan, this is a Finding.

Fix text

Develop, document and implement label security requirements. Install and configure label security in accordance with the System Security Plan. Monitor and audit changes to the label security configuration.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.