V-270574

Discussion

This control is intended to address the confidentiality and integrity of information at rest in nonmobile devices and covers user information and system information. Information at rest refers to the state of information when it is located on a secondary storage device (e.g., disk drive, tape drive) within an organizational information system. Applications and application users generate information throughout the course of their application use. User-generated data and application-specific configuration data must be protected. Configurations and/or rule sets for firewalls, gateways, intrusion detection/prevention systems, and filtering routers and authenticator content are examples of system information likely requiring protection. Organizations may choose to employ different mechanisms to achieve confidentiality and integrity protections, as appropriate. If the confidentiality and integrity of application data is not protected, the data will be open to compromise and unauthorized modification. Oracle recommends using Transparent Data Encryption, which is part of Oracle Advanced Security Option, to protect data.

Check Content

Review system documentation to determine whether the system handles classified information. If the system does not handle classified information, the severity of this check is downgraded to CAT II. 
 
If the application owner and authorizing official (AO) have determined that encryption of data at rest is required, verify the data on secondary devices is encrypted. 
 
If full-disk encryption is being used, this is not a finding. 

If data encryption is required, verify the data is encrypted before being put on the secondary device. To ensure the appropriate controls are in place, discuss the precautions taken with the site database administrators (DBAs) and system administrators (SAs).

The following SQL statement lists all tablespaces and whether not they are encrypted:

$ sqlplus connect as sysdba

SELECT TABLESPACE_NAME, ENCRYPTED
FROM DBA_TABLESPACES
WHERE CONTENTS NOT IN ('TEMPORARY', 'UNDO')
AND TABLESPACE_NAME NOT IN ('SYSTEM', 'SYSAUX');

For each tablespace where encryption is required, verify encryption is in effect. If it is not, this is a finding.