Title: The DBMS must enforce requirements for remote connections to the information system.
Vulnerability ID: V-32422
IA Controls: None
Description: Applications that provide remote access to information systems must be able to enforce remote access policy requirements or work in conjunction with enterprise tools designed to enforce policy requirements. Examples of policy requirements include, but are not limited to, authorizing remote access to the information system, limiting access based on authentication credentials, and monitoring for unauthorized access.
If databases allowing remote connections do not enforce requirements for remote access, an attacker may gain access to the database and may, through the database, gain access to other components of the information system.
Check Text: Review organization’s access control policies and procedures addressing remote access to the information system.
If remote connections are not allowed by the organization, this is NA.
Review the DBMS settings to verify access controls and auditing settings exist and they enforce the requirements for remote access defined by the organization. If access controls and auditing do not exist or do not fully enforce the requirements defined in the organization’s policies and procedures, this is a finding.
Fix Text: Configure DBMS settings to ensure access control and auditing requirements for remote connections are enforced by the DBMS.