O121-BP-024100 - DBMS production application and data directories must be protected from developers on shared production/development DBMS host systems.

Information

Developer roles must not be assigned DBMS administrative privileges to production DBMS application and data directories. The separation of production DBA and developer roles helps protect the production system from unauthorized, malicious or unintentional interruption due to development activities.

Solution

Create separate DBMS host OS groups for developer and production DBAs.

Do not assign production DBA OS group membership to accounts used for development.

Remove development accounts from production DBA OS group membership.

Recommend establishing a dedicated DBMS host for production DBMS installations. A dedicated host system in this case refers to an instance of the operating system at a minimum. The operating system may reside on a virtual host machine where supported by the DBMS vendor.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_12c_V3R1_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-219852r961863_rule, STIG-ID|O121-BP-024100, STIG-Legacy|SV-75977, STIG-Legacy|V-61487, Vuln-ID|V-219852

Plugin: Unix

Control ID: be643aac2c2d6b71d23ccefa641b7125ba11c5d9d2af880d922b4fea44f1e5e1