Oracle Database 19c STIG

16 items · Security · Hard difficulty · 1 week

Essential steps to secure Oracle Database 19c per STIG guidance.

• Inventory database and take full backup

  Record versions, patch level, configuration, and take a verified full backup before changes.

• Apply Oracle CPU and PSU patches

  Install latest Critical Patch Updates and Patch Set Updates from Oracle.

• Secure SYS and SYSTEM accounts

  Lock or rename default accounts and use dedicated administrative accounts.

• Enforce least privilege for database accounts

  Remove unnecessary DBA roles and grant minimal privileges required for tasks.

• Configure strong password and authentication policies

  Set complexity, expiration, reuse, and account lockout policies per guidelines.

• Enable and configure unified auditing

  Turn on unified audit framework to capture privileged and security-related events.

• Enable Oracle unified auditing

  Activate unified auditing at the database level if not already enabled.

• Create audit policies for privileged actions

  Define and enable policies for SYS, DDL, privilege changes, and login failures.

• Encrypt sensitive data at rest using Transparent Data Encryption (TDE)

  Enable TDE for tablespaces or columns that store sensitive information.

• Enable TLS for client connections and secure interconnect

  Configure strong ciphers and enforce certificate validation for clients and replication.

• Secure Oracle Net Listener configuration

  Restrict listener access, require valid node checking, and remove unsecured endpoints.

• Restrict network access and firewall database ports

  Limit database ports to authorized hosts, and use network segmentation.

• Harden file system and OS permissions for Oracle files

  Ensure proper ownership and minimal permissions on Oracle binaries and datafiles.

• Remove or disable unused sample schemas and demo objects

  Drop or secure sample schemas and example code that could expose data.

• Implement monitoring and log review procedures

  Forward audit logs to SIEM and schedule regular reviews of security events.

• Schedule regular backup restore and disaster recovery tests

  Periodically test restores to validate backups and recovery procedures.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.