DG0067-ORACLE11 - Database account passwords should be stored in encoded or encrypted format whether stored in database objects, external host files, environment variables or any other storage locations.

Information

Database passwords stored in clear text are vulnerable to unauthorized disclosure. Database passwords should always be encoded or encrypted when stored internally or externally to the DBMS.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Develop, document and maintain a list of DBMS database objects, database configuration files, associated scripts and applications defined within or external to the DBMS that access the database, and DBMS / user environment files/settings in the System Security Plan.

Record whether they do or do not contain DBMS passwords.

If passwords are present, ensure they are encoded or encrypted and protected by host system security.

Consider using vendor or 3rd party tools to support external authentication (i.e. Oracle Database Vault).

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_11g_Y21M10_STIG.zip

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-5(1)(c), CAT|I, Rule-ID|SV-24641r1_rule, STIG-ID|DG0067-ORACLE11, Vuln-ID|V-3812

Plugin: Unix

Control ID: 1b27b053c4b7adb12ccf8a25a39994f73d8445294263596b55558fc5ac6f0b8e