Enable Database Logging Rule

Rule Description:

Troubleshooting Steps:

2. 1.

   Check Database Logging Status: Verify if database logging is enabled or disabled by checking the database configuration settings or contacting the database administrator.

4. 2.

   Review Database Logs: Examine the existing database logs to determine if any security events or anomalies have been recorded. Ensure that the logs capture a sufficient level of detail to meet the compliance requirements of NIST 800-171 Revision 2.

6. 3.

   Enable Database Logging: If database logging is currently disabled, follow the appropriate steps to enable logging for the specific database management system in use. Refer to the database documentation or consult with the database vendor or administrator for detailed instructions.

8. 4.

   Configure Database Log Settings: Adjust the database log settings to capture the necessary event types and level of detail required to comply with NIST 800-171 Revision 2. Consider enabling logging for critical events such as user authentication, privilege changes, access control modifications, and any other relevant activities related to sensitive information.

10. 5.

    Test Logging Functionality: Validate that the database logging is functioning correctly by performing test transactions or simulating security events to ensure they are being logged and captured in the database logs.

12. 6.

    Monitor and Maintain Logs: Regularly review and analyze the database logs to detect any suspicious activities, unauthorized access attempts, or policy violations. Establish a process for the retention and archiving of logs to comply with regulatory requirements and facilitate forensic investigations, if necessary.

Necessary Configuration Codes:

Microsoft SQL Server:

EXEC sp_changedboption 'DatabaseName', 'single user', 'true';
ALTER DATABASE DatabaseName SET RECOVERY FULL;
EXEC sp_changedboption 'DatabaseName', 'single user', 'false';

Oracle Database:

ALTER DATABASE ADD SUPPLEMENTAL LOG DATA;

MySQL:

general_log = 1

Remediation Steps:

Microsoft SQL Server:

2. 1.

   Connect to the SQL Server instance using appropriate credentials through SQL Server Management Studio (SSMS) or any preferred SQL management tool.

4. 2.

   Open a new query window and execute the following query to enable single-user mode for the target database:

EXEC sp_changedboption 'DatabaseName', 'single user', 'true';

2. 1.
   Set the database recovery model to 'FULL' using the following query:

ALTER DATABASE DatabaseName SET RECOVERY FULL;

2. 1.
   Disable single-user mode for the database:

EXEC sp_changedboption 'DatabaseName', 'single user', 'false';

2. 1.
   Repeat these steps for each database requiring database logging.

Oracle Database:

2. 1.

   Connect to the Oracle Database using SQL*Plus or any preferred Oracle management tool as the Oracle SYSDBA user.

4. 2.

   Run the following command to add supplemental log data:

ALTER DATABASE ADD SUPPLEMENTAL LOG DATA;

2. 1.
   Ensure that all necessary databases have supplemental log data enabled.

MySQL:

2. 1.

   Locate the MySQL configuration file – my.cnf (Linux) or my.ini (Windows). The file is typically located in the MySQL installation directory.

4. 2.

   Open the configuration file in a text editor.

6. 3.

   Look for the section titled

   [mysqld]

   and add the following line if it doesn't already exist:

general_log = 1

2. 1.

   Save the configuration file.

4. 2.

   Restart the MySQL service to apply the changes.