Title: DBMS default account names must be changed.
Vulnerability ID: V-32246
IA Controls: None
Description: Default accounts are usually accounts that have special privileges required to administer the database. Well-known DBMS account names are targeted most frequently by attackers and are thus more prone to providing unauthorized access to the database.
If default account names are not changed an attacker has a predefined list of accounts to target. Since most default accounts are administrative in nature, the compromise of a default account can have catastrophic consequences including the complete loss of control over the information system.
Check Text: Review the list of default account names provided by the DBMS. The list may be provided in vendor documentation or obtained using Internet resources. If default account names exist, this is a finding.
Fix Text: Modify default DBMS accounts to use custom account names.[divider]