Oracle Autonomous AI Database Compliance Standards

Ensure 'AUDIT_SYS_OPERATIONS' Is Set to 'TRUE'

Description: The AUDIT_SYS_OPERATIONS setting provides for the auditing of all user activities conducted under the SYSOPER and SYSDBA accounts. The setting should be set to TRUE to enable this auditing.

Ensure 'AUDIT_TRAIL' Is Set to 'DB', 'XML', 'OS', 'DB,EXTENDED', or 'XML,EXTENDED'

Description: The audit_trail setting determines whether or not Oracle's basic audit features are enabled. It can be set to "Operating System"( OS ); DB ; DB,EXTENDED ; XML ; or XML,EXTENDED. The value should be set according to the needs of the organization.

Ensure 'GLOBAL_NAMES' Is Set to 'TRUE'

Description: The global_names setting requires that the name of a database link matches that of the remote database it will connect to. This setting should have a value of TRUE.

Ensure 'OS_ROLES' Is Set to 'FALSE'

Description: The os_roles setting permits externally created groups to be applied to database management.

Ensure 'REMOTE_LISTENER' Is Empty

Description: The remote_listener setting determines whether or not a valid listener can be established on a system separate from the database instance. This setting should be empty unless the organization specifically needs a valid listener on a separate system or on nodes running Oracle RAC instances.

Ensure 'REMOTE_LOGIN_PASSWORDFILE' Is Set to 'NONE'

Description: The remote_login_passwordfile setting specifies whether or not Oracle checks for a password file during login and how many databases can use the password file. The setting should have a value of NONE or in the event you are running DR/Data Guard, EXCLUSIVE is an allowable value.

Ensure 'REMOTE_OS_AUTHENT' Is Set to 'FALSE'

Description: The remote_os_authent setting determines whether or not OS 'roles' with the attendant privileges are allowed for remote client connections. This setting should have a value of FALSE. Note: This parameter has been deprecated in 12.1 and higher versions.

Ensure 'REMOTE_OS_ROLES' Is Set to 'FALSE'

Description: The remote_os_roles setting permits remote users' OS roles to be applied to database management. This setting should have a value of FALSE.

Ensure 'SEC_CASE_SENSITIVE_LOGON' Is Set to 'TRUE'

Description: The SEC_CASE_SENSITIVE_LOGON information determines whether or not case-sensitivity is required for passwords during login. Note: This parameter has been deprecated in 12.1 and higher versions.

Ensure 'SEC_MAX_FAILED_LOGIN_ATTEMPTS' Is '3' or Less

Description: The SEC_MAX_FAILED_LOGIN_ATTEMPTS parameter determines how many failed login attempts are allowed before Oracle closes the login connection.

Ensure 'SEC_PROTOCOL_ERROR_FURTHER_ACTION' Is Set to '(DROP,3)'

Description: The SEC_PROTOCOL_ERROR_FURTHER_ACTION setting determines the Oracle server's response to bad/malformed packets received from the client. This setting should have a value of (DROP,3) or (DROP, 3), which will cause a connection to be dropped after three bad/malformed packets.

Ensure 'SEC_PROTOCOL_ERROR_TRACE_ACTION' Is Set to 'LOG'

Description: The SEC_PROTOCOL_ERROR_TRACE_ACTION setting determines the Oracle server's logging response level to bad/malformed packets received from the client by generating ALERT, LOG, or TRACE levels of detail in the log files. This setting should have a value of LOG unless the organization has a compelling reason to use a different value because LOG should cause the necessary information to be logged. Setting the value as TRACE can generate an enormous amount of log output and should be reserved for debugging only.

Ensure 'SEC_RETURN_SERVER_RELEASE_BANNER' Is Set to 'FALSE'

Description: The information about patch/update release number provides information about the exact patch/update release that is currently running on the database. This is sensitive information that should not be revealed to anyone who requests it.

Ensure 'SQL92_SECURITY' Is Set to 'TRUE'

Description: The SQL92_SECURITY parameter setting TRUE requires that a user must also be granted the SELECT object privilege before being able to perform UPDATE or DELETE operations on tables that have WHERE or SET clauses. The setting should have a value of TRUE.

Ensure '_trace_files_public' Is Set to 'FALSE'

Description: Confirm that the _trace_files_public parameter is set to FALSE.

Ensure 'RESOURCE_LIMIT' Is Set to 'TRUE'

Description: RESOURCE_LIMIT determines whether resource limits are enforced in database profiles. This setting should have a value of TRUE.

Ensure 'PASSWORD_LOCK_TIME' Is Greater than or Equal to '1'

Description: The PASSWORD_LOCK_TIME setting determines how many days must pass for the user's account to be unlocked after the set number of failed login attempts has occurred. The suggested value for this is one day or greater.

Ensure 'PASSWORD_VERIFY_FUNCTION' Is Set for All Profiles

Description: The PASSWORD_VERIFY_FUNCTION determines password settings requirements when a user password is changed at the SQL command prompt. It should be set for all profiles. Note that this setting does not apply for users managed by the Oracle password file.

Ensure All Default Passwords Are Changed

Description: Default passwords should not be used by Oracle database users.

Ensure 'DBA_USERS.AUTHENTICATION_TYPE' Is Not Set to 'EXTERNAL' for Any User

Description: The authentication_type='EXTERNAL' setting determines whether or not a user can be authenticated by a remote OS to allow access to the database with full authorization. This setting should not be used.

Ensure 'SYS.USER$MIG' Has Been Dropped

Description: The table sys.user$mig is created during migration and contains the Oracle password hashes before the migration starts. This table should be dropped.

Ensure No Public Database Links Exist

Description: Public Database links are used to allow connections between databases.

Ensure 'EXECUTE' is revoked from 'PUBLIC' on "Java" Packages

Description: Oracle Database PL/SQL Java packages DBMS_JAVA and DBMS_JAVA_TEST provide APIs to run Java classes or grant Java privileges. The user PUBLIC should not be able to execute these packages. The Oracle database DBMS_JAVA package can run Java classes (e.g. OS commands) or grant Java privileges. The user PUBLIC should not be able to execute DBMS_JAVA. The Oracle database DBMS_JAVA_TEST package can run Java classes (e.g. OS commands) or grant Java privileges. The user PUBLIC should not be able to execute DBMS_JAVA_TEST.

Ensure 'EXECUTE' is not granted to 'PUBLIC' on "Non-default" Packages

Description: The packages described in this control are not granted to PUBLIC by default ("Non-default" packages). These packages should not be granted to PUBLIC. The Oracle database DBMS_BACKUP_RESTORE package is used for applying PL/SQL commands to the native RMAN sequences. The Oracle database DBMS_FILE_TRANSFER package allows a user to transfer files from one database server to another. The Oracle database DBMS_SYS_SQL, DBMS_REPCAT_SQL_UTL, INITJVMAUX, DBMS_AQADM_SYS, DBMS_STREAMS_RPC, DBMS_PRVTAQIM, LTADM and DBMS_IJOB packages are shipped as undocumented.

Ensure 'ALL' Is Revoked on 'Sensitive' Tables

Description: The Oracle database tables listed below may contain sensitive information, and should not be accessible to unauthorized users. USER$, USER_HISTORY$, XS$VERIFIERS and DEFAULT_PWD$ may contain password hashes. CDB_LOCAL_ADMINAUTH$ and PDB_SYNC$ may contain DDLs. LINK$ and SCHEDULER$_CREDENTIAL may contain encrypted passwords. ENC$ may contain encryption keys. HISTGRM$ and HIST_HEAD$ may contain sensitive data.

Ensure 'EXECUTE ANY PROCEDURE' Is Revoked from 'OUTLN'

Description: Remove unneeded EXECUTE ANY PROCEDURE privileges from OUTLN.

Ensure 'EXECUTE ANY PROCEDURE' Is Revoked from 'DBSNMP'

Description: Remove unneeded EXECUTE ANY PROCEDURE privileges from DBSNMP.

Ensure 'SELECT ANY DICTIONARY' Is Revoked from Unauthorized 'GRANTEE'

Description: The Oracle database SELECT ANY DICTIONARY privilege allows the designated user to access SYS schema objects. Unauthorized grantees should not have that privilege.

Ensure 'SELECT ANY TABLE' Is Revoked from Unauthorized 'GRANTEE'

Description: The Oracle database SELECT ANY TABLE privilege allows the designated user to open any table, except SYS, to view it. Unauthorized grantees should not have that privilege.

Ensure 'AUDIT SYSTEM' Is Revoked from Unauthorized 'GRANTEE'

Description: The Oracle database AUDIT SYSTEM privilege allows changes to auditing activities on the system. Unauthorized grantees should not have that privilege.

Ensure 'EXEMPT ACCESS POLICY' Is Revoked from Unauthorized 'GRANTEE'

Description: The Oracle database EXEMPT ACCESS POLICY keyword provides the user the capability to access all the table rows regardless of row-level security lockouts. Unauthorized grantees should not have that keyword assigned to them.

Ensure 'BECOME USER' Is Revoked from Unauthorized 'GRANTEE'

Description: The Oracle database BECOME USER privilege allows the designated user to inherit the rights of another user. Unauthorized grantees should not have that privilege.

Ensure 'CREATE ANY LIBRARY' Is Revoked from Unauthorized 'GRANTEE'

Description: The Oracle database CREATE ANY LIBRARY privilege allows the designated user to create objects that are associated to the shared libraries. Unauthorized grantees should not have that privilege.

Ensure 'CREATE LIBRARY' Is Revoked from Unauthorized 'GRANTEE'

Description: The Oracle database CREATE LIBRARY privilege allows the designated user to create objects that are associated to the shared libraries. Unauthorized grantees should not have that privilege.

Ensure 'GRANT ANY OBJECT PRIVILEGE' Is Revoked from Unauthorized 'GRANTEE'

Description: The Oracle database GRANT ANY OBJECT PRIVILEGE keyword provides the grantee the capability to grant access to any single or multiple combinations of objects to any grantee in the catalog of the database. Unauthorized grantees should not have that keyword assigned to them.

Ensure 'GRANT ANY PRIVILEGE' Is Revoked from Unauthorized 'GRANTEE'

Description: The Oracle database GRANT ANY PRIVILEGE keyword provides the grantee the capability to grant any single privilege to any item in the catalog of the database. Unauthorized grantees should not have that privilege.

Ensure 'EXECUTE_CATALOG_ROLE' Is Revoked from Unauthorized 'GRANTEE'

Description: The Oracle database EXECUTE_CATALOG_ROLE provides EXECUTE privileges for a number of packages and procedures in the data dictionary in the SYS schema. Unauthorized grantees should not have that role.

Ensure the 'USER' Audit Option Is Enabled

Description: The USER object allows for creating accounts that can interact with the database according to the roles and privileges allotted to the account. It may also own database objects. Enabling the audit option causes auditing of all activities and requests to create, drop or alter a user, including a user changing their own password. (The latter is not audited by audit ALTER USER.)

Ensure the 'ROLE' Audit Option Is Enabled

Description: The ROLE object allows for the creation of a set of privileges that can be granted to users or other roles. Enabling the audit option causes auditing of all attempts, successful or not, to create, drop, alter or set roles.

Ensure the 'SYSTEM GRANT' Audit Option Is Enabled

Description: Enabling the audit option for the SYSTEM GRANT object causes auditing of any attempt, successful or not, to grant or revoke any system privilege or role, regardless of privilege held by the user attempting the operation.

Ensure the 'PROFILE' Audit Option Is Enabled

Description: The PROFILE object allows for the creation of a set of database resource limits that can be assigned to a user, so that user cannot exceed those resource limitations. Enabling the audit option causes auditing of all attempts, successful or not, to create, drop or alter any profile.

Ensure the 'DATABASE LINK' Audit Option Is Enabled

Description: Enabling the audit option for the DATABASE LINK object causes all activities on database links to be audited.

Ensure the 'PUBLIC DATABASE LINK' Audit Option Is Enabled

Description: The PUBLIC DATABASE LINK object allows for the creation of a public link for an application-based "user" to access the database for connections/session creation. Enabling the audit option causes all user activities involving the creation, alteration, or dropping of public links to be audited.

Ensure the 'PUBLIC SYNONYM' Audit Option Is Enabled

Description: The PUBLIC SYNONYM object allows for the creation of an alternate description of an object. Public synonyms are accessible by all users that have the appropriate privileges to the underlying object. Enabling the audit option causes all user activities involving the creation or dropping of public synonyms to be audited.

Ensure the 'SYNONYM' Audit Option Is Enabled

Description: The SYNONYM operation allows for the creation of an alternative name for a database object such as a Java class schema object, materialized view, operator, package, procedure, sequence, stored function, table, view, user-defined object type, or even another synonym. This synonym puts a dependency on its target and is rendered invalid if the target object is changed/dropped. Enabling the audit option causes all user activities involving the creation or dropping of synonyms to be audited.

Ensure the 'DIRECTORY' Audit Option Is Enabled

Description: The DIRECTORY object allows for the creation of a directory object that specifies an alias for a directory on the server file system, where the external binary file LOBs ( BFILEs )/ table data are located. Enabling this audit option causes all user activities involving the creation or dropping of a directory alias to be audited.

Ensure the 'SELECT ANY DICTIONARY' Audit Option Is Enabled

Description: The SELECT ANY DICTIONARY capability allows the user to view the definitions of all schema objects in the database. Enabling the audit option causes all user activities involving this capability to be audited.

Ensure the 'GRANT ANY OBJECT PRIVILEGE' Audit Option Is Enabled

Description: GRANT ANY OBJECT PRIVILEGE allows the user to grant or revoke any object privilege, which includes privileges on tables, directories, mining models, etc. Enabling this audit option causes auditing of all uses of that privilege.

Ensure the 'GRANT ANY PRIVILEGE' Audit Option Is Enabled

Description: GRANT ANY PRIVILEGE allows a user to grant any system privilege, including the most powerful privileges typically available only to administrators - to change the security infrastructure, to drop/add/modify users and more.

Ensure the 'DROP ANY PROCEDURE' Audit Option Is Enabled

Description: The AUDIT DROP ANY PROCEDURE command is auditing the dropping of procedures. Enabling the option causes auditing of all such activities.

Ensure the 'PROCEDURE' Audit Option Is Enabled

Description: In this statement audit, PROCEDURE means any procedure, function, package or library. Enabling this audit option causes any attempt, successful or not, to create or drop any of these types of objects to be audited, regardless of privilege or lack thereof. Java schema objects (sources, classes, and resources) are considered the same as procedures for the purposes of auditing SQL statements.

Ensure the 'ALTER SYSTEM' Audit Option Is Enabled

Description: ALTER SYSTEM allows one to change instance settings, including security settings and auditing options. Additionally, ALTER SYSTEM can be used to run operating system commands using undocumented Oracle functionality. Enabling the audit option will audit all attempts to perform ALTER SYSTEM, whether successful or not and regardless of whether or not the ALTER SYSTEM privilege is held by the user attempting the action.

Ensure the 'TRIGGER' Audit Option Is Enabled

Description: A TRIGGER may be used to modify DML actions or invoke other (recursive) actions when some types of user-initiated actions occur. Enabling this audit option will cause auditing of any attempt, successful or not, to create, drop, enable or disable any schema trigger in any schema regardless of privilege or lack thereof. For enabling and disabling a trigger, it covers both ALTER TRIGGER and ALTER TABLE.

Ensure the 'CREATE SESSION' Audit Option Is Enabled

Description: Enabling this audit option will cause auditing of all attempts to connect to the database, whether successful or not, as well as audit session disconnects/logoffs. The commands to audit SESSION, CONNECT or CREATE SESSION all accomplish the same thing - they initiate statement auditing of the connect statement used to create a database session.

17 Oracle Autonomous AI Database Compliance Standards

Security Best Practices for Oracle Autonomous AI Database 19c