Title: The DBMS must maintain and support organization defined security labels on stored information.
Vulnerability ID: V-32163
IA Controls: None
Description: Security attributes are abstractions representing the basic properties or characteristics of an entity (e.g., subjects and objects) with respect to safeguarding information.
These attributes are typically associated with internal data structures (e.g., records, buffers, files) within the information system and are used to enable the implementation of access control and flow control policies, reflect special dissemination, handling or distribution instructions, or support other aspects of the information security policy.
One example includes marking data as classified or FOUO. These security attributes may be assigned manually or during data processing but either way, it is imperative these assignments are maintained while the data is in storage. If the security attributes are lost when the data is stored, there is the risk of a data compromise.
The sensitivity marking or labeling of stored data items promotes the correct handling and protection of data. Without such notification, the user may unwittingly disclose sensitive data to unauthorized users.
Check Text: Review system documentation to determine if the labeling of sensitive data is required under organization defined guidelines. If the labeling of sensitive data is not required, this is NA.
Review the DBMS configuration regarding the marking and labeling of stored information. If stored information is not being labeled with the organization defined security labels, this is a finding.
Fix Text: Document the appropriate organization defined security labels in the system documentation. Configure the DBMS to label sensitive data, stored within the DBMS, with organization defined labels.[divider]