Detections
Analytics

EP11-00-005700 - The EDB Postgres Advanced Server must protect the confidentiality and integrity of all information at rest.

Information

This control is intended to address the confidentiality and integrity of information at rest in non-mobile devices and covers user information and system information. Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive) within an organizational information system. Applications and application users generate information throughout the course of their application use.

User data generated, as well as application-specific configuration data, must be protected. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate.

If the confidentiality and integrity of application data is not protected, the data will be open to compromise and unauthorized modification.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Complete these steps as the Windows user that serves as the user who is configure to run the EDB Postgres database service. If done as a different user, the Windows database service user will be unable to view this folder and therefore unable to start the database. By default, the service is configured to be run by the NetworkService account, which is a special Windows account that may not have the ability to encrypt the data directory. As a result, it may be necessary to change the service to run under a different account that can access the directory and encrypt it.

Use the following steps, to update the service, encrypt the data directory, and restart the service:
1. Change the edb-as-11 service to run as a local user account that is the same domain user that will be used to encrypt the data directory (ex. 'administrator').
Open Computer Management >> Services.
Highlight the 'edb-as-11 service'.
Stop the service.
Select the service properties.
Select the 'Log On' tab, and update the 'Log on as' setting to an account such as 'Administrator'.

2. Encrypt the data directory by following these instructions (logged in as the user who runs the service):
Right-click on <postgresql data directory>, select properties, select the Advanced button in the General tab, and then select the 'Encrypt contents to secure data' checkbox in the 'Advanced Attributes' window. Select the option to apply to subfolders and files when prompted.

3. Restart the EDB service after encrypting the drive.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_EDB_PGS_Advanced_Server_v11_Windows_V2R4_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-28, CAT|I, CCI|CCI-001199, Rule-ID|SV-224178r961128_rule, STIG-ID|EP11-00-005700, STIG-Legacy|SV-109483, STIG-Legacy|V-100379, Vuln-ID|V-224178

Plugin: Windows

Control ID: c1e9cf25b7d248d55e5c45754f92f527f2808de4ba85f18ad2aa99bd236bb09f