DISA_STIG_EnterpriseDB_Postgres_Advanced_Server_v2r1_OS_Linux.audit from DISA EnterpriseDB Postgres Advanced Server (EPAS) v2r1 STIG

EPAS-00-000700 - The EDB Postgres Advanced Server must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals.

800-53|AC-2(1)

CAT|I

CCI|CCI-000015

Rule-ID|SV-259211r960768_rule

STIG-ID|EPAS-00-000700

Vuln-ID|V-259211

EPAS-00-000800 - The EDB Postgres Advanced Server must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

800-53|AC-3

CCI|CCI-000213

Rule-ID|SV-259212r960792_rule

STIG-ID|EPAS-00-000800

Vuln-ID|V-259212

EPAS-00-001100 - The EDB Postgres Advanced Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.

800-53|AU-12b.

CAT|II

CCI|CCI-000171

Rule-ID|SV-259215r960882_rule

STIG-ID|EPAS-00-001100

Vuln-ID|V-259215

EPAS-00-002300 - The EDB Postgres Advanced Server must, by default, shut down upon audit failure, to include the unavailability of space for more audit log records; or must be configurable to shut down upon audit failure.

800-53|AU-5b.

CCI|CCI-000140

Rule-ID|SV-259226r960915_rule

STIG-ID|EPAS-00-002300

Vuln-ID|V-259226

EPAS-00-002400 - The EDB Postgres Advanced Server must be configurable to overwrite audit log records, oldest first (First-In-First-Out [FIFO]), in the event of unavailability of space for more audit log records.

Rule-ID|SV-259227r960915_rule

STIG-ID|EPAS-00-002400

Vuln-ID|V-259227

EPAS-00-002600 - The audit information produced by the EDB Postgres Advanced Server must be protected from unauthorized read access.

800-53|AU-9

CCI|CCI-000162

Rule-ID|SV-259228r960930_rule

STIG-ID|EPAS-00-002600

Vuln-ID|V-259228

EPAS-00-002700 - The audit information produced by the EDB Postgres Advanced Server must be protected from unauthorized modification.

CCI|CCI-000163

Rule-ID|SV-259229r960933_rule

STIG-ID|EPAS-00-002700

Vuln-ID|V-259229

EPAS-00-002800 - The audit information produced by the EDB Postgres Advanced Server must be protected from unauthorized deletion.

CCI|CCI-000164

Rule-ID|SV-259230r960936_rule

STIG-ID|EPAS-00-002800

Vuln-ID|V-259230

EPAS-00-002900 - The EDB Postgres Advanced Server must protect its audit features from unauthorized access.

CCI|CCI-001493

Rule-ID|SV-259231r960939_rule

STIG-ID|EPAS-00-002900

Vuln-ID|V-259231

EPAS-00-003000 - The EDB Postgres Advanced Server must protect its audit configuration from unauthorized modification.

CCI|CCI-001494

Rule-ID|SV-259232r960942_rule

STIG-ID|EPAS-00-003000

Vuln-ID|V-259232

EPAS-00-003100 - The EDB Postgres Advanced Server must protect its audit features from unauthorized removal.

CCI|CCI-001495

Rule-ID|SV-259233r960945_rule

STIG-ID|EPAS-00-003100

Vuln-ID|V-259233

EPAS-00-003200 - Software, applications, and configuration files that are part of, or related to, the EDB Postgres Advanced Server installation must be monitored to discover unauthorized changes.

800-53|CM-5(6)

CCI|CCI-001499

Rule-ID|SV-259234r960960_rule

STIG-ID|EPAS-00-003200

Vuln-ID|V-259234

EPAS-00-003400 - Database software, including EDB Postgres Advanced Server configuration files, must be stored in dedicated directories, separate from the host OS and other applications.

Rule-ID|SV-259237r960960_rule

STIG-ID|EPAS-00-003400

Vuln-ID|V-259237

EPAS-00-003600 - The role(s)/group(s) used to modify database structure and logic modules must be restricted to authorized users.

Rule-ID|SV-259239r960960_rule

STIG-ID|EPAS-00-003600

Vuln-ID|V-259239

EPAS-00-003800 - Unused database components, EDB Postgres Advanced Server software, and database objects must be removed.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-259241r960963_rule

STIG-ID|EPAS-00-003800

Vuln-ID|V-259241

EPAS-00-003900 - Unused database components which are integrated in the EDB Postgres Advanced Server and cannot be uninstalled must be disabled.

Rule-ID|SV-259242r960963_rule

STIG-ID|EPAS-00-003900

Vuln-ID|V-259242

EPAS-00-004000 - Access to external executables must be disabled or restricted.

Rule-ID|SV-259243r960963_rule

STIG-ID|EPAS-00-004000

Vuln-ID|V-259243

EPAS-00-004200 - The EDB Postgres Advanced Server must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

800-53|IA-2

CCI|CCI-000764

Rule-ID|SV-259245r960969_rule

STIG-ID|EPAS-00-004200

Vuln-ID|V-259245

EPAS-00-004400 - If passwords are used for authentication, the EDB Postgres Advanced Server must transmit only encrypted representations of passwords.

800-53|IA-5(1)(c)

CCI|CCI-000197

Rule-ID|SV-259248r961029_rule

STIG-ID|EPAS-00-004400

Vuln-ID|V-259248

EPAS-00-004500 - The EDB Postgres Advanced Server, when utilizing PKI-based authentication, must validate certificates by performing RFC 5280-compliant certification path validation.

800-53|IA-5(2)(a)

CCI|CCI-000185

Rule-ID|SV-259249r961038_rule

STIG-ID|EPAS-00-004500

Vuln-ID|V-259249

EPAS-00-004600 - The EDB Postgres Advanced Server must enforce authorized access to all PKI private keys stored/used by the EDB Postgres Advanced Server.

800-53|IA-5(2)(b)

CCI|CCI-000186

Rule-ID|SV-259250r961041_rule

STIG-ID|EPAS-00-004600

Vuln-ID|V-259250

EPAS-00-004700 - The DBMS must map the PKI-authenticated identity to an associated user account.

800-53|IA-5(2)(c)

CCI|CCI-000187

Rule-ID|SV-259251r961044_rule

STIG-ID|EPAS-00-004700

Vuln-ID|V-259251

EPAS-00-004900 - The EDB Postgres Advanced Server must use NIST FIPS 140-2 or 140-3 validated cryptographic modules for cryptographic operations.

800-53|IA-7

CCI|CCI-000803

Rule-ID|SV-259254r961050_rule

STIG-ID|EPAS-00-004900

Vuln-ID|V-259254

EPAS-00-004950 - The EDB Postgres Advanced Server must be configured on a platform that has a NIST-certified FIPS 140-2 or 140-3 installation of OpenSSL.

Rule-ID|SV-259255r961050_rule

STIG-ID|EPAS-00-004950

Vuln-ID|V-259255

EPAS-00-005000 - The EDB Postgres Advanced Server must uniquely identify and authenticate nonorganizational users (or processes acting on behalf of nonorganizational users).

800-53|IA-8

CCI|CCI-000804

Rule-ID|SV-259256r961053_rule

STIG-ID|EPAS-00-005000

Vuln-ID|V-259256

EPAS-00-005100 - The EDB Postgres Advanced Server must separate user functionality (including user interface services) from database management functionality.

800-53|SC-2

CCI|CCI-001082

Rule-ID|SV-259257r961095_rule

STIG-ID|EPAS-00-005100

Vuln-ID|V-259257

EPAS-00-006100 - Access to database files must be limited to relevant processes and to authorized, administrative users.

800-53|SC-4

CCI|CCI-001090

Rule-ID|SV-259262r961149_rule

STIG-ID|EPAS-00-006100

Vuln-ID|V-259262

EPAS-00-007300 - The EDB Postgres Advanced Server must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects.

800-53|AC-3(4)

CCI|CCI-002165

Rule-ID|SV-259272r961317_rule

STIG-ID|EPAS-00-007300

Vuln-ID|V-259272

EPAS-00-007400 - The EDB Postgres Advanced Server must prevent nonprivileged users from executing privileged functions to include disabling, circumventing, or altering implemented security safeguards/countermeasures.

800-53|AC-6(10)

CCI|CCI-002235

Rule-ID|SV-259273r961353_rule

STIG-ID|EPAS-00-007400

Vuln-ID|V-259273

EPAS-00-008700 - The EDB Postgres Advanced Server must disable network functions, ports, protocols, and services deemed by the organization to be nonsecure, in accord with the Ports, Protocols, and Services Management (PPSM) guidance.

800-53|CM-7(1)(b)

CCI|CCI-001762

Rule-ID|SV-259286r961470_rule

STIG-ID|EPAS-00-008700

Vuln-ID|V-259286

EPAS-00-009100 - The EDB Postgres Advanced Server must only accept end entity certificates issued by DOD PKI or DOD-approved PKI Certification Authorities (CAs) for the establishment of all encrypted sessions.

800-53|SC-23(5)

CCI|CCI-002470

Rule-ID|SV-259289r961596_rule

STIG-ID|EPAS-00-009100

Vuln-ID|V-259289

EPAS-00-009200 - The EDB Postgres Advanced Server must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.

800-53|SC-28(1)

CCI|CCI-002475

Rule-ID|SV-259290r961599_rule

STIG-ID|EPAS-00-009200

Vuln-ID|V-259290

EPAS-00-009300 - The EDB Postgres Advanced Server must implement cryptographic mechanisms preventing the unauthorized disclosure of organization-defined information at rest on organization-defined information system components.

CCI|CCI-002476

Rule-ID|SV-259291r961602_rule

STIG-ID|EPAS-00-009300

Vuln-ID|V-259291

EPAS-00-009500 - The EDB Postgres Advanced Server must maintain the confidentiality and integrity of information during preparation for transmission.

800-53|SC-8(2)

CCI|CCI-002420

Rule-ID|SV-259292r961638_rule

STIG-ID|EPAS-00-009500

Vuln-ID|V-259292

EPAS-00-012700 - The EDB Postgres Advanced Server must implement NIST FIPS 140-2 or 140-3 validated cryptographic modules to provision digital signatures.

800-53|SC-13

CCI|CCI-002450

Rule-ID|SV-259325r961857_rule

STIG-ID|EPAS-00-012700

Vuln-ID|V-259325

EPAS-00-012800 - The EDB Postgres Advanced Server must implement NIST FIPS 140-2 or 140-3 validated cryptographic modules to generate and validate cryptographic hashes.

Rule-ID|SV-259326r961857_rule

STIG-ID|EPAS-00-012800

Vuln-ID|V-259326

EPAS-00-012900 - The EDB Postgres Advanced Server must implement NIST FIPS 140-2 or 140-3 validated cryptographic modules to protect unclassified information requiring confidentiality and cryptographic protection, in accordance with the requirements of the data owner.

Rule-ID|SV-259327r961857_rule

Detections

Analytics

EnterpriseDB PostgreSQL Advanced Server OS Linux v2r1

Audit Details

File Details

Audit Changelog

No revisions found