Oracle Database production application and data directories must be protected from developers on shared production/development database management system (DBMS) host systems.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-270536	SRG-APP-000516-DB-000363	O19C-00-010600	SV-270536r1064886_rule	2025-02-14	1

Description
Developer roles must not be assigned DBMS administrative privileges to production DBMS application and data directories. The separation of production database administrator (DBA) and developer roles helps protect the production system from unauthorized, malicious, or unintentional interruption due to development activities.

ℹ️ Check
If the DBMS or DBMS host is not shared by production and development activities, this check is not a finding. Review OS DBA group membership. If any developer accounts, as identified in the system documentation, have been assigned DBA privileges, this is a finding. Note: Though shared production/nonproduction DBMS installations was allowed under previous database STIG guidance, doing so may place it in violation of OS, Application, Network, or Enclave STIG guidance. Ensure that any shared production/nonproduction DBMS installation meets STIG guidance requirements at all levels or mitigates any conflicts in STIG guidance with the authorizing official (AO).

ℹ️ Check

If the DBMS or DBMS host is not shared by production and development activities, this check is not a finding. Review OS DBA group membership. If any developer accounts, as identified in the system documentation, have been assigned DBA privileges, this is a finding. Note: Though shared production/nonproduction DBMS installations was allowed under previous database STIG guidance, doing so may place it in violation of OS, Application, Network, or Enclave STIG guidance. Ensure that any shared production/nonproduction DBMS installation meets STIG guidance requirements at all levels or mitigates any conflicts in STIG guidance with the authorizing official (AO).

✔️ Fix
Create separate DBMS host OS groups for developer and production DBAs. Do not assign production DBA OS group membership to accounts used for development. Remove development accounts from production DBA OS group membership. Recommend establishing a dedicated DBMS host for production DBMS installations. A dedicated host system in this case refers to an instance of the operating system at a minimum. The operating system may reside on a virtual host machine where supported by the DBMS vendor.

✔️ Fix

Create separate DBMS host OS groups for developer and production DBAs. Do not assign production DBA OS group membership to accounts used for development. Remove development accounts from production DBA OS group membership. Recommend establishing a dedicated DBMS host for production DBMS installations. A dedicated host system in this case refers to an instance of the operating system at a minimum. The operating system may reside on a virtual host machine where supported by the DBMS vendor.