DoD STIGs – V-32366

Overview:

Title: The DBMS must provide the capability to capture, record, and log all content related to a user session.

Vulnerability ID: V-32366

STIG ID:

IA Controls: None

Severity: medium

Description: While a great deal of effort is made to secure applications to prevent unauthorized access, in certain instances there can be valid requirements to capture, record, and log all content related to a particular user’s application session.

These instances are reserved for monitoring or investigative purposes supported through policy and are officially sanctioned. Session auditing activities are developed, integrated, and used in consultation with legal counsel in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations.

These monitoring events occur at the application layer and as such, may be required to be conducted at a host system however in some cases network monitoring may be involved, as well.

Applications must support valid monitoring requirement capabilities performed in accordance with applicable federal laws, Executive Orders, directives, policies, or regulations. This includes the capability to capture, record, and log all content related to an established user session.

Check Text: Verify, using vendor documentation if required, the DBMS is capable of capturing, recording, and logging all content related to an established user session. If the DBMS is not capable of these actions, this is a finding.

Fix Text: Utilize a DBMS capable of capturing, recording, and logging all content related to an established user session, or acquire a third party application to perform this function.

[divider]

Interpreting V-32366:

SQL Server provides many ways for the capture, recording, and logging of all content related to an established user session. Depending on the level of audit required you can configure the system to record just login success or failures, all the way to every action the logged in individual performs.

Return to the DoD STIGs – Database Security Requirements Guide

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.