All use of privileged accounts must be audited.

From Oracle Database 11.2g Security Technical Implementation Guide

Associated with: CCI-000040

SV-66605r2_rule All use of privileged accounts must be audited.

Vulnerability discussion

This is intended to limit exposure, by making it possible to trace any unauthorized access, by a privileged user account or role that has permissions on security functions or security-relevant information, to other data or functionality.

Check content

Review auditing configuration. If it is possible for a privileged user/role to access non-security functions or information, without having the action recorded in the audit log, this is a finding.

Fix text

Configure DBMS auditing so that all use of privileged accounts is recorded in the audit log.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.