DISA_STIG_EDB_PostgreSQL_Advanced_Server_v11_Windows_v2r2_OS.audit from DISA EDB Postgres Advanced Server v11 on Windows v2r2 STIG

EP11-00-000700 - The EDB Postgres Advanced Server must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

CAT|I

CCI|CCI-000015

Rule-ID|SV-224131r836871_rule

STIG-ID|EP11-00-000700

STIG-Legacy|SV-109393

STIG-Legacy|V-100289

Vuln-ID|V-224131

EP11-00-001100 - The EDB Postgres Advanced Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - data dir

CAT|II

CCI|CCI-000171

Rule-ID|SV-224135r508023_rule

STIG-ID|EP11-00-001100

STIG-Legacy|SV-109401

STIG-Legacy|V-100297

Vuln-ID|V-224135

EP11-00-001100 - The EDB Postgres Advanced Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - data\*

EP11-00-001100 - The EDB Postgres Advanced Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - postgresql.conf

EP11-00-002300 - The EDB Postgres Advanced Server must by default shut down upon audit failure, to include the unavailability of space for more audit log records; or must be configurable to shut down upon audit failure.

CCI|CCI-000140

Rule-ID|SV-224146r508023_rule

STIG-ID|EP11-00-002300

STIG-Legacy|SV-109423

STIG-Legacy|V-100319

Vuln-ID|V-224146

EP11-00-002400 - The EDB Postgres Advanced Server must be configurable to overwrite audit log records, oldest first (First-In-First-Out - FIFO), in the event of unavailability of space for more audit log records.

Rule-ID|SV-224147r508023_rule

STIG-ID|EP11-00-002400

STIG-Legacy|SV-109425

STIG-Legacy|V-100321

Vuln-ID|V-224147

EP11-00-002600 - The audit information produced by the EDB Postgres Advanced Server must be protected from unauthorized read access.

CCI|CCI-000162

Rule-ID|SV-224148r508023_rule

STIG-ID|EP11-00-002600

STIG-Legacy|SV-109427

STIG-Legacy|V-100323

Vuln-ID|V-224148

EP11-00-002700 - The audit information produced by the EDB Postgres Advanced Server must be protected from unauthorized modification.

CCI|CCI-000163

Rule-ID|SV-224149r508023_rule

STIG-ID|EP11-00-002700

STIG-Legacy|SV-109429

STIG-Legacy|V-100325

Vuln-ID|V-224149

EP11-00-002800 - The audit information produced by the EDB Postgres Advanced Server must be protected from unauthorized deletion.

CCI|CCI-000164

Rule-ID|SV-224150r508023_rule

STIG-ID|EP11-00-002800

STIG-Legacy|SV-109431

STIG-Legacy|V-100327

Vuln-ID|V-224150

EP11-00-002900 - The EDB Postgres Advanced Server must protect its audit features from unauthorized access.

CCI|CCI-001493

Rule-ID|SV-224151r508023_rule

STIG-ID|EP11-00-002900

STIG-Legacy|SV-109433

STIG-Legacy|V-100329

Vuln-ID|V-224151

EP11-00-003000 - The EDB Postgres Advanced Server must protect its audit configuration from unauthorized modification.

CCI|CCI-001494

Rule-ID|SV-224152r508023_rule

STIG-ID|EP11-00-003000

STIG-Legacy|SV-109435

STIG-Legacy|V-100331

Vuln-ID|V-224152

EP11-00-003100 - The EDB Postgres Advanced Server must protect its audit features from unauthorized removal.

CCI|CCI-001495

Rule-ID|SV-224153r508023_rule

STIG-ID|EP11-00-003100

STIG-Legacy|SV-109437

STIG-Legacy|V-100333

Vuln-ID|V-224153

EP11-00-003200 - Software, applications, and configuration files that are part of, or related to, the Postgres Plus Advanced Server installation must be monitored to discover unauthorized changes.

CCI|CCI-001499

Rule-ID|SV-224154r508023_rule

STIG-ID|EP11-00-003200

STIG-Legacy|SV-109439

STIG-Legacy|V-100335

Vuln-ID|V-224154

EP11-00-003400 - Database software, including EDB Postgres Advanced Server configuration files, must be stored in dedicated directories, separate from the host OS and other applications.

Rule-ID|SV-224157r508023_rule

STIG-ID|EP11-00-003400

STIG-Legacy|SV-109445

STIG-Legacy|V-100341

Vuln-ID|V-224157

EP11-00-003600 - The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to the EDB Postgres Advanced Server, etc.) must be restricted to authorized users.

Rule-ID|SV-224159r508023_rule

STIG-ID|EP11-00-003600

STIG-Legacy|SV-109449

STIG-Legacy|V-100345

Vuln-ID|V-224159

EP11-00-003800 - Unused database components, EDB Postgres Advanced Server software, and database objects must be removed.

CCI|CCI-000381

Rule-ID|SV-224161r508023_rule

STIG-ID|EP11-00-003800

STIG-Legacy|SV-109453

STIG-Legacy|V-100349

Vuln-ID|V-224161

EP11-00-003900 - Unused database components which are integrated in the EDB Postgres Advanced Server and cannot be uninstalled must be disabled.

Rule-ID|SV-224162r508023_rule

STIG-ID|EP11-00-003900

STIG-Legacy|SV-109455

STIG-Legacy|V-100351

Vuln-ID|V-224162

EP11-00-004000 - Access to external executables must be disabled or restricted.

Rule-ID|SV-224163r508023_rule

STIG-ID|EP11-00-004000

STIG-Legacy|SV-109457

STIG-Legacy|V-100353

Vuln-ID|V-224163

EP11-00-004200 - The EDB Postgres Advanced Server must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

CCI|CCI-000764

Rule-ID|SV-224165r508023_rule

STIG-ID|EP11-00-004200

STIG-Legacy|SV-109461

STIG-Legacy|V-100357

Vuln-ID|V-224165

EP11-00-004400 - If passwords are used for authentication, the EDB Postgres Advanced Server must transmit only encrypted representations of passwords.

CCI|CCI-000197

Rule-ID|SV-224168r836876_rule

STIG-ID|EP11-00-004400

STIG-Legacy|SV-109467

STIG-Legacy|V-100363

Vuln-ID|V-224168

EP11-00-004500 - The EDB Postgres Advanced Server, when utilizing PKI-based authentication, must validate certificates by performing RFC 5280-compliant certification path validation.

CCI|CCI-000185

Rule-ID|SV-224169r508023_rule

STIG-ID|EP11-00-004500

STIG-Legacy|SV-109469

STIG-Legacy|V-100365

Vuln-ID|V-224169

EP11-00-004600 - The EDB Postgres Advanced Server must enforce authorized access to all PKI private keys stored/utilized by the EDB Postgres Advanced Server.

CCI|CCI-000186

Rule-ID|SV-224170r836877_rule

STIG-ID|EP11-00-004600

STIG-Legacy|SV-109471

STIG-Legacy|V-100367

Vuln-ID|V-224170

EP11-00-004850 - The EDB Postgres Advanced Server password file must not be used.

CCI|CCI-000366

Rule-ID|SV-224173r508023_rule

STIG-ID|EP11-00-004850

STIG-Legacy|SV-110213

STIG-Legacy|V-101109

Vuln-ID|V-224173

EP11-00-004900 - The EDB Postgres Advanced Server must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for all cryptographic operations including generation of cryptographic hashes and data protection - alg_section

CCI|CCI-000803

CCI|CCI-002450

Rule-ID|SV-224174r836880_rule

STIG-ID|EP11-00-004900

STIG-Legacy|SV-109477

STIG-Legacy|V-100373

Vuln-ID|V-224174

EP11-00-004900 - The EDB Postgres Advanced Server must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for all cryptographic operations including generation of cryptographic hashes and data protection - fips_mode

EP11-00-004900 - The EDB Postgres Advanced Server must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for all cryptographic operations including generation of cryptographic hashes and data protection - hostssl

EP11-00-004900 - The EDB Postgres Advanced Server must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for all cryptographic operations including generation of cryptographic hashes and data protection - openssl_conf

EP11-00-005700 - The EDB Postgres Advanced Server must protect the confidentiality and integrity of all information at rest.

CCI|CCI-001199

Rule-ID|SV-224178r836881_rule

STIG-ID|EP11-00-005700

STIG-Legacy|SV-109483

STIG-Legacy|V-100379

Vuln-ID|V-224178

EP11-00-006100 - Access to database files must be limited to relevant processes and to authorized, administrative users.

CCI|CCI-001090

Rule-ID|SV-224181r508023_rule

STIG-ID|EP11-00-006100

STIG-Legacy|SV-109489

STIG-Legacy|V-100385

Vuln-ID|V-224181

EP11-00-008000 - The EDB Postgres Advanced Server must provide a warning to appropriate support staff when allocated audit record storage volume reaches 75% of maximum audit record storage capacity.

CCI|CCI-001855

Rule-ID|SV-224198r508023_rule

STIG-ID|EP11-00-008000

STIG-Legacy|SV-109521

STIG-Legacy|V-100417

Vuln-ID|V-224198

EP11-00-008400 - The EDB Postgres Advanced Server must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status.

CCI|CCI-001812

Rule-ID|SV-224200r508023_rule

STIG-ID|EP11-00-008400

STIG-Legacy|SV-109525

STIG-Legacy|V-100421

Vuln-ID|V-224200

EP11-00-008500 - The EDB Postgres Advanced Server must enforce access restrictions associated with changes to the configuration of the EDB Postgres Advanced Server or database(s).

CCI|CCI-001813

Rule-ID|SV-224201r508023_rule

STIG-ID|EP11-00-008500

STIG-Legacy|SV-109527

STIG-Legacy|V-100423

Vuln-ID|V-224201

EP11-00-008700 - The EDB Postgres Advanced Server must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.

CCI|CCI-001762

Rule-ID|SV-224203r508023_rule

STIG-ID|EP11-00-008700

STIG-Legacy|SV-109531

STIG-Legacy|V-100427

Vuln-ID|V-224203

EP11-00-009100 - The EDB Postgres Advanced Server must only accept end entity certificates issued by DoD PKI or DoD-approved PKI Certification Authorities (CAs) for the establishment of all encrypted sessions.

Detections

Analytics

EDB PostgreSQL Advanced Server v11 Windows OS Audit v2r2

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Added

Revision 1.1

Miscellaneous


Revision 1.4 Jun 17, 2024 Miscellaneous Metadata updated.
Revision 1.3 Apr 30, 2024 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.2 Apr 12, 2023 Miscellaneous Metadata updated. Platform check updated. Added DISA_STIG_EDB_PostgreSQL_Advanced_Server_v11_Windows_v2r2_OS.audit from DISA EDB Postgres Advanced Server v11 on Windows v2r2 STIG
Revision 1.1 Mar 7, 2023 Miscellaneous Metadata updated. References updated.