STIGhubSTIGhub
STIGsSearchCompareAbout

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • VPAT
  • DISA STIG Library
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

Oracle Database 11.2g Security Technical Implementation Guide

Version

V2R5

Benchmark ID

Oracle_Database_11-2g_STIG

Total Checks

142

Tags

database
CAT I: 12CAT II: 128CAT III: 2

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSON

Checks (142)

V-219695MEDIUMAccess to default accounts used to support replication must be restricted to authorized DBAs.V-219696MEDIUMOracle instance names must not contain Oracle version numbers.V-219697MEDIUMFixed user and public database links must be authorized for use.V-219698LOWA minimum of two Oracle control files must be defined and configured to be stored on separate, archived disks (physical or virtual) or archived partitions on a RAID device.V-219699MEDIUMA minimum of two Oracle redo log groups/files must be defined and configured to be stored on separate, archived physical disks or archived directories on a RAID device.V-219700MEDIUMThe Oracle WITH GRANT OPTION privilege must not be granted to non-DBA or non-Application administrator user accounts.V-219701MEDIUMExecute permission must be revoked from PUBLIC for restricted Oracle packages.V-219702HIGHThe Oracle REMOTE_OS_AUTHENT parameter must be set to FALSE.V-219703HIGHThe Oracle REMOTE_OS_ROLES parameter must be set to FALSE.V-219704MEDIUMThe Oracle SQL92_SECURITY parameter must be set to TRUE.V-219705MEDIUMThe Oracle password file ownership and permissions should be limited and the REMOTE_LOGIN_PASSWORDFILE parameter must be set to EXCLUSIVE or NONE.V-219706MEDIUMSystem privileges granted using the WITH ADMIN OPTION must not be granted to unauthorized user accounts.V-219707MEDIUMSystem Privileges must not be granted to PUBLIC.V-219708MEDIUMOracle roles granted using the WITH ADMIN OPTION must not be granted to unauthorized accounts.V-219709MEDIUMObject permissions granted to PUBLIC must be restricted.V-219710HIGHThe Oracle Listener must be configured to require administration authentication.V-219711MEDIUMApplication role permissions must not be assigned to the Oracle PUBLIC role.V-219712MEDIUMOracle application administration roles must be disabled if not required and authorized.V-219713MEDIUMConnections by mid-tier web and application systems to the Oracle DBMS from a DMZ or external network must be encrypted.V-219714MEDIUMDatabase job/batch queues must be reviewed regularly to detect unauthorized database job submissions.V-219715MEDIUMUnauthorized database links must not be defined and active.V-219716MEDIUMSensitive information from production database exports must be modified before being imported into a development database.V-219719MEDIUMOnly authorized system accounts must have the SYSTEM tablespace specified as the default tablespace.V-219720MEDIUMApplication owner accounts must have a dedicated application tablespace.V-219721MEDIUMThe directories assigned to the LOG_ARCHIVE_DEST* parameters must be protected from unauthorized access.V-219722MEDIUMThe Oracle _TRACE_FILES_PUBLIC parameter if present must be set to FALSE.V-219723MEDIUMApplication object owner accounts must be disabled when not performing installation or maintenance actions.V-219724MEDIUMDBMS production application and data directories must be protected from developers on shared production/development DBMS host systems.V-219725MEDIUMUse of the DBMS installation account must be logged.V-219733MEDIUMThe directory assigned to the AUDIT_FILE_DEST parameter must be protected from unauthorized access and must be stored in a dedicated directory or disk partition separate from software or other application files.V-219736MEDIUMAccess to DBMS software files and directories must not be granted to unauthorized users.V-219737MEDIUMReplication accounts must not be granted DBA privileges.V-219738MEDIUMNetwork access to the DBMS must be restricted to authorized personnel.V-219739MEDIUMChanges to configuration options must be audited.V-219742MEDIUMChanges to DBMS security labels must be audited.V-219743MEDIUMRemote database or other external access must use fully-qualified names.V-219744MEDIUMThe /diag subdirectory under the directory assigned to the DIAGNOSTIC_DEST parameter must be protected from unauthorized access.V-219745MEDIUMRemote administration must be disabled for the Oracle connection manager.V-219746MEDIUMThe SQLNet SQLNET.ALLOWED_LOGON_VERSION parameter must be set to a value of 12 or higher.V-219747HIGHThe DBMS, when using PKI-based authentication, must enforce authorized access to the corresponding private key.V-219748MEDIUMThe DBMS must limit the number of concurrent sessions for each system account to an organization-defined number of sessions.V-219749MEDIUMThe system must employ automated mechanisms for supporting Oracle user account management.V-219750MEDIUMThe DBMS must enforce approved authorizations for logical access to the system in accordance with applicable policy.V-219751MEDIUMThe DBMS must provide audit record generation capability for organization-defined auditable events within the database.V-219752MEDIUMThe DBMS must allow designated organizational personnel to select which auditable events are to be audited by the database.V-219753MEDIUMThe DBMS must generate audit records for the DoD-selected list of auditable events, to the extent such information is available.V-219754MEDIUMThe DBMS must produce audit records containing sufficient information to establish what type of events occurred.V-219755MEDIUMThe DBMS must produce audit records containing sufficient information to establish when (date and time) the events occurred.V-219756MEDIUMThe DBMS must produce audit records containing sufficient information to establish where the events occurred.V-219757MEDIUMThe DBMS must produce audit records containing sufficient information to establish the sources (origins) of the events.V-219758MEDIUMThe DBMS must produce audit records containing sufficient information to establish the outcome (success or failure) of the events.V-219759MEDIUMThe DBMS must produce audit records containing sufficient information to establish the identity of any user/subject or process associated with the event.V-219760MEDIUMThe DBMS must include organization-defined additional, more detailed information in the audit records for audit events identified by type, location, or subject.V-219761MEDIUMThe DBMS must protect audit information from any type of unauthorized access.V-219762MEDIUMThe DBMS must protect audit information from unauthorized modification.V-219763MEDIUMThe DBMS must protect audit information from unauthorized deletion.V-219764MEDIUMThe DBMS must protect audit tools from unauthorized access.V-219765MEDIUMThe DBMS must protect audit tools from unauthorized modification.V-219766MEDIUMThe DBMS must protect audit tools from unauthorized deletion.V-219767MEDIUMDatabase objects must be owned by accounts authorized for ownership.V-219768MEDIUMDefault demonstration and sample databases, database objects, and applications must be removed.V-219769MEDIUMUnused database components, DBMS software, and database objects must be removed.V-219770MEDIUMUnused database components that are integrated in the DBMS and cannot be uninstalled must be disabled.V-219771MEDIUMUse of external executables must be authorized.V-219772MEDIUMAccess to external executables must be disabled or restricted.V-219773MEDIUMThe DBMS must support the organizational requirements to specifically prohibit or restrict the use of unauthorized functions, ports, protocols, and/or services.V-219774MEDIUMThe DBMS must support organizational requirements to enforce password encryption for storage.V-219775MEDIUMThe DBMS, when utilizing PKI-based authentication, must validate certificates by constructing a certification path with status information to an accepted trust anchor.V-219776MEDIUMThe DBMS must ensure that PKI-based authentication maps the authenticated identity to the user account.V-219777MEDIUMProcesses (services, applications, etc.) that connect to the DBMS independently of individual users, must use valid, current DoD-issued PKI certificates for authentication to the DBMS.V-219778MEDIUMThe DBMS must use NIST-validated FIPS 140-2-compliant cryptography for authentication mechanisms.V-219779MEDIUMThe DBMS must terminate user sessions upon user logout or any other organization or policy-defined session termination events, such as idle time limit exceeded.V-219780MEDIUMThe DBMS must preserve any organization-defined system state information in the event of a system failure.V-219781MEDIUMThe DBMS must take needed steps to protect data at rest and ensure confidentiality and integrity of application data.V-219782MEDIUMThe DBMS must isolate security functions from non-security functions by means of separate security domains.V-219783MEDIUMThe DBMS must prevent unauthorized and unintended information transfer via shared system resources.V-219784MEDIUMThe DBMS must check the validity of data inputs.V-219785MEDIUMThe DBMS must only generate error messages that provide information necessary for corrective actions without revealing organization-defined sensitive or potentially harmful information in error logs and administrative messages that could be exploited.V-219786MEDIUMThe DBMS must restrict error messages, so only authorized personnel may view them.V-219787HIGHApplications must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.V-219788HIGHWhen using command-line tools such as Oracle SQL*Plus, which can accept a plain-text password, users must use an alternative login method that does not expose the password.V-219789MEDIUMDisk space used by audit trail(s) must be monitored; audit records must be regularly or continuously offloaded to a centralized log management system.V-219790MEDIUMDatabase software, applications, and configuration files must be monitored to discover unauthorized changes.V-219791MEDIUMLogic modules within the database (to include packages, procedures, functions and triggers) must be monitored to discover unauthorized changes.V-219792MEDIUMThe DBMS software installation account must be restricted to authorized users.V-219793MEDIUMDatabase software directories, including DBMS configuration files, must be stored in dedicated directories, or DASD pools, separate from the host OS and other applications.V-219794MEDIUMThe DBMS must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).V-219795MEDIUMThe DBMS must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).V-219796MEDIUMThe DBMS must separate user functionality (including user interface services) from database management functionality.V-219797LOWThe DBMS must protect against an individual using a group account from falsely denying having performed a particular action.V-238431HIGHDBA OS accounts must be granted only those host system privileges necessary for the administration of the DBMS.V-238432HIGHVendor-supported software must be evaluated and patched against newly found vulnerabilities.V-238433HIGHDBMS default accounts must be assigned custom passwords.V-238434HIGHThe DBMS must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission unless the transmitted data is otherwise protected by alternative physical measures.V-238435MEDIUMThe DBMS must support the disabling of network protocols deemed by the organization to be non-secure.V-238436MEDIUMThe DBMS must provide a mechanism to automatically identify accounts designated as temporary or emergency accounts.V-238437MEDIUMThe DBMS must provide a mechanism to automatically terminate accounts designated as temporary or emergency accounts after an organization-defined time period.V-238438MEDIUMThe DBMS must enforce Discretionary Access Control (DAC) policy allowing users to specify and control sharing by named individuals, groups of individuals, or by both, limiting propagation of access rights and includes or excludes access to the granularity of a single user.V-238439MEDIUMThe DBMS must restrict grants to sensitive information to authorized user roles.V-238440MEDIUMA single database connection configuration file must not be used to configure all database clients.V-238441MEDIUMThe DBMS must be protected from unauthorized access by developers.V-238442MEDIUMThe DBMS must be protected from unauthorized access by developers on shared production/development host systems.V-238443MEDIUMThe DBMS must restrict access to system tables and other configuration information or metadata to DBAs or other authorized users.V-238444MEDIUMAdministrative privileges must be assigned to database accounts via database roles.V-238445MEDIUMAdministrators must utilize a separate, distinct administrative account when performing administrative activities, accessing database security functions, or accessing security-relevant information.V-238446MEDIUMThe DBA role must not be assigned excessive or unauthorized privileges.V-238447MEDIUMOS accounts utilized to run external procedures called by the DBMS must have limited privileges.V-238448MEDIUMThe DBMS must specify an account lockout duration that is greater than or equal to the organization-approved minimum.V-238449MEDIUMThe DBMS must have the capability to limit the number of failed login attempts based upon an organization-defined number of consecutive invalid attempts occurring within an organization-defined time period.V-238450MEDIUMDatabases utilizing Discretionary Access Control (DAC) must enforce a policy that limits propagation of access rights.V-238451MEDIUMA DBMS utilizing Discretionary Access Control (DAC) must enforce a policy that includes or excludes access to the granularity of a single user.V-238452MEDIUMThe DBMS itself, or the logging or alerting mechanism the application utilizes, must provide a warning when allocated audit record storage volume reaches an organization-defined percentage of maximum audit record storage capacity.V-238453MEDIUMThe DBMS must provide a real-time alert when organization-defined audit failure events occur.V-238454MEDIUMThe DBMS must support enforcement of logical access restrictions associated with changes to the DBMS configuration and to the database itself.V-238455MEDIUMDatabase backup procedures must be defined, documented, and implemented.V-238456MEDIUMDatabase recovery procedures must be developed, documented, implemented, and periodically tested.V-238457MEDIUMDBMS backup and restoration files must be protected from unauthorized access.V-238458HIGHThe DBMS must use multifactor authentication for access to user accounts.V-238459MEDIUMThe DBMS must ensure users are authenticated with an individual authenticator prior to using a group authenticator.V-238460MEDIUMThe DBMS must disable user accounts after 35 days of inactivity.V-238461MEDIUMThe DBMS must support organizational requirements to enforce minimum password length.V-238462MEDIUMThe DBMS must support organizational requirements to prohibit password reuse for the organization-defined number of generations.V-238463MEDIUMThe DBMS must support organizational requirements to enforce password complexity by the number of upper-case characters used.V-238464MEDIUMThe DBMS must support organizational requirements to enforce password complexity by the number of lower-case characters used.V-238465MEDIUMThe DBMS must support organizational requirements to enforce password complexity by the number of numeric characters used.V-238466MEDIUMThe DBMS must support organizational requirements to enforce password complexity by the number of special characters used.V-238467MEDIUMThe DBMS must support organizational requirements to enforce the number of characters that get changed when passwords are changed.V-238468MEDIUMProcedures for establishing temporary passwords that meet DoD password requirements for new accounts must be defined, documented, and implemented.V-238469MEDIUMDBMS passwords must not be stored in compiled, encoded, or encrypted batch jobs or compiled, encoded, or encrypted application source code.V-238470MEDIUMThe DBMS must enforce password maximum lifetime restrictions.V-238471MEDIUMThe DBMS must employ cryptographic mechanisms to protect the integrity and confidentiality of non-local maintenance and diagnostic communications.V-238472MEDIUMThe DBMS must employ strong identification and authentication techniques when establishing non-local maintenance and diagnostic sessions.V-238473MEDIUMThe DBMS must terminate the network connection associated with a communications session at the end of the session or after 15 minutes of inactivity.V-238474MEDIUMThe DBMS must implement required cryptographic protections using cryptographic modules complying with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.V-238475MEDIUMDatabase data files containing sensitive information must be encrypted.V-238476MEDIUMThe DBMS must automatically terminate emergency accounts after an organization-defined time period for each type of account.V-238477MEDIUMThe DBMS must protect against or limit the effects of the organization-defined types of Denial of Service (DoS) attacks.V-238478MEDIUMThe DBMS must verify there have not been unauthorized changes to the DBMS software and information.V-238479MEDIUMThe DBMS must support taking organization-defined list of least disruptive actions to terminate suspicious events.V-238480MEDIUMUse of the DBMS software installation account must be restricted.V-238481MEDIUMThe OS must limit privileges to change the DBMS software resident within software libraries (including privileged programs).V-265878HIGHOracle database products must be a version supported by the vendor.