Edit D:\app\Administrator\product\11.2.0\dbhome_1\sysman\admin\emdrep\rsc\db\policy\db

Edit D:\app\Administrator\product\11.2.0\dbhome_1\sysman\admin\emdrep\rsc\db\policy\db_policies.dlf

<?xml version="1.0" encoding="UTF-8" ?>

<lookup-key>
  <column name="MESSAGE_ID"/>
  <column name="SUBSYSTEM"/>
  <column name="LANGUAGE_CODE"/>
  <column name="COUNTRY_CODE"/>
</lookup-key>

<columns>
  <column name="MESSAGE_ID" type="string" maxsize="256"/>
  <column name="SUBSYSTEM" type="string" maxsize="64"/>
  <column name="LANGUAGE_CODE" type="string" constant="en" translate="yes"/>
  <column name="COUNTRY_CODE" type="string" constant=" " translate="yes"/>
  <column name="MESSAGE" type="string" maxsize="1000" translate="yes"/>
</columns>

<dataset>

<row>
    <col name="MESSAGE_ID">USR_DFLT_TBSPC_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Default Table Space</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">USR_DFLT_TBSPC_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures users are not assigned SYSTEM or SYSAUX as their default tablespace</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">USR_DFLT_TBSPC_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Users objects are created in the default tablespaces. An incorrectly set default tablespace (SYSTEM or SYSAUX) for a user can consume all available space thus causing the database to stop working.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">USR_DFLT_TBSPC_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Reassign the tablespace of users having SYSTEM or SYSAUX defined as their default tablespace.</col>
  </row>

<row>
    <col name="MESSAGE_ID">USR_TEMP_TABSPC_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">User Temporary Table Space</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">USR_TEMP_TABSPC_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures users are not assigned SYSTEM or SYSAUX as their temporary tablespace</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">USR_TEMP_TABSPC_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">The user's temporary objects are created in the temporary tablespace. An incorrectly set temporary tablespace (SYSTEM or SYSAUX) for a user can consume all available space thus causing the database to stop working.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">USR_TEMP_TABSPC_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Reassign the tablespace of  users having SYSTEM or SYSAUX defined as their default temporary tablespace.</col>
  </row>

<row>
    <col name="MESSAGE_ID">TABLESPACE_QUOTA_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Unlimited Tablespace Quota</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">TABLESPACE_QUOTA_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures database users are allocated a limited tablespace quota</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">TABLESPACE_QUOTA_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Granting unlimited tablespace quotas can cause the filling up of the allocated disk space. This can lead to an unresponsive database.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">TABLESPACE_QUOTA_REOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">For users with an unlimited tablespace quota, reallocate their tablespace quotas to a specific limit.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">AUDIT_FILE_DEST_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Audit File Destination</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">AUDIT_FILE_DEST_NAME_NT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Audit File Destination (Windows)</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">AUDIT_FILE_DEST_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that access to the audit files directory is restricted to the owner of the Oracle software set and the DBA group.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">AUDIT_FILE_DEST_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">The AUDIT_FILE_DEST initialization parameter specifies the directory where the Oracle auditing facility creates the audit files. Giving public read permission to this directory may reveal important information such as logging information of startup, shutdown, and privileged connections.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">AUDIT_FILE_DEST_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict permissions to the Audit File directory to the owner of the Oracle software set and DBA group. Do not give read, write, and execute permissions to public.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">USER_DUMP_DEST_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">User Dump Destination</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">USER_DUMP_DEST_NAME_NT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">User Dump Destination (Windows)</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">USER_DUMP_DEST_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that access to the trace files directory is restricted to the owner of the Oracle software set and the DBA group</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">USER_DUMP_DEST_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">The trace files for server processes are stored in the directory specified by the USER_DUMP_DEST initialization parameter. Giving public read permission to this directory may reveal important and sensitive internal details of the database and applications.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">USER_DUMP_DEST_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict permissions to the user dump directory to the owner of the Oracle software set and DBA group. Do not give read, write, and execute permissions to public.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">BKGRND_DUMP_DEST_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Background Dump Destination</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">BKGRND_DUMP_DEST_NAME_NT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Background Dump Destination (Windows)</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">BKGRND_DUMP_DEST_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that access to the trace files directory is restricted to the owner of the Oracle software set and the DBA group</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">BKGRND_DUMP_DEST_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Background processes such as the log writer process and the database writer process use trace files to record occurrences and exceptions of database operations, as well as errors. The trace files are stored in the directory specified by the BACKGROUND_DUMP_DEST initialization parameter. Giving public read permission to this directory may reveal important and sensitive internal details of the database and applications.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">BKGRND_DUMP_DEST_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict permissions to the background dump directory to the owner of the Oracle software set and DBA group. Do not give read, write, and execute permissions to public.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">CORE_DUMP_DEST_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Core Dump Destination</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">CORE_DUMP_DEST_NAME_NT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Core Dump Destination (Windows)</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">CORE_DUMP_DEST_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that access to the core dump files directory is restricted to the owner of the Oracle software set and the DBA group</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">CORE_DUMP_DEST_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Core dump files are stored in the directory specified by the CORE_DUMP_DEST initialization parameter. A public read privilege on this directory could expose sensitive information from the core dump files.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">CORE_DUMP_DEST_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict permissions to the core dump directory to the owner of the Oracle software set and DBA group. Do not give read, write, and execute permissions to public.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">CONTROL_FILES_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Control File Permission</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">CONTROL_FILES_NAME_NT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Control File Permission (Windows)</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">CONTROL_FILES_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that access to the control files directory is restricted to the owner of the Oracle software set and the DBA group</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">CONTROL_FILES_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Control files are binary configuration files that control access to data files. Control files are stored in the directory specified by the CONTROL_FILES initialization parameter. A public write privilege on this directory could pose a serious security risk.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">CONTROL_FILES_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict permissions to the control files directory to the owner of the Oracle software set and DBA group. Do not give read and write permissions to public.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">OH_DATAFILES_PERM_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Oracle Home Datafile Permission</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_DATAFILES_PERM_NAME_NT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Oracle Home Datafile Permission (Windows)</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_DATAFILES_PERM_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that access to the datafiles is restricted to the owner of the Oracle software set and the DBA group</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_DATAFILES_PERM_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">The datafiles contain all the database data. If datafiles are readable to public, they can be read by a user who has no database privileges on the data.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_DATAFILES_PERM_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict permissions to the datafiles to the owner of the Oracle software set and DBA group. Do not give read and write permissions to public.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">OH_SPFILE_PERM_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Server Parameter File Permission</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_SPFILE_PERM_NAME_NT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Server Parameter File Permission (Windows)</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_SPFILE_PERM_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that access to the server paramater file is restricted to the owner of the Oracle software set and the DBA group</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_SPFILE_PERM_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">A server parameter file (SPFILE) lets you store and manage your initialization parameters persistently in a server-side disk file. A publicly accessible SPFILE can be scanned for sensitive initialization parameters exposing the security policies of the database. The SPFILE can also be searched for the weaknesses of the Oracle database configuration setting.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_SPFILE_PERM_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict permissions to the server parameter file (SPFILE) to the owner of the Oracle software set and DBA group. Do not give read and write permissions to public.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">OH_INITORA_PERM_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Initialization Parameter File Permission</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_INITORA_PERM_NAME_NT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Initialization Parameter File Permission (Windows)</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_INITORA_PERM_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that access to the initialization paramater file is restricted to the owner of the Oracle software set and the DBA group</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_INITORA_PERM_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Oracle traditionally stores initialization parameters in a text initialization parameter file. A publicly accessible initialization parameter file can be scanned for sensitive initialization parameters exposing the security policies of the database. The IFILE can also be searched for the weaknesses of the Oracle database configuration setting.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_INITORA_PERM_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict permissions to the initialization parameter file to the owner of the Oracle software set and DBA group. Do not give read and write permissions to public.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">OH_IFILE_PERM_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">IFILE Referenced File Permission</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_IFILE_PERM_NAME_NT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">IFILE Referenced File Permission (Windows)</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_IFILE_PERM_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that access to the files referenced by the IFILE parameter is restricted to the owner of the Oracle software set and the DBA group</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_IFILE_PERM_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">The IFILE initialization parameter can be used to embed the contents of another initialization parameter file into the current initialization parameter file. A publicly accessible initialization parameter file can be scanned for sensitive initialization parameters exposing the security policies of the database. Initialization parameter file can also be searched for the weaknesses of the Oracle database configuration setting.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_IFILE_PERM_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict permissions to the files referenced by the IFILE initialization parameter file to the owner of the Oracle software set and DBA group. Do not give read, write, and execute permissions to public.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">OH_BIN_FILE_OWNER_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Oracle Home Executable Files Owner</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_BIN_FILE_OWNER_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that the ownership of all files and directories in the ORACLE_HOME/bin folder is the same as the Oracle software installation owner</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_BIN_FILE_OWNER_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Incorrect file permissions on some of the Oracle files can cause major security issues.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_BIN_FILE_OWNER_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">For files and directories in the ORACLE_HOME/bin folder that do not have the same owner as the Oracle software installation, change their owner to the installation owner.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">EXE_FILE_PERM_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Oracle Home Executable Files Permission</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">EXE_FILE_PERM_NAME_NT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Oracle Home Executable Files Permission (Windows)</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">EXE_FILE_PERM_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that all files in the ORACLE_HOME/bin folder do not have public write permission</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">EXE_FILE_PERM_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Incorrect file permissions on some of the Oracle files can cause major security issues.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">EXE_FILE_PERM_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict permissions to all files in the ORACLE_HOME/bin  to the owner of the Oracle software set and DBA group. Do not give write permission to public.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">OH_FILEPERM_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Oracle Home File Permission</col>
  </row>
  
  <row>
    <col name="MESSAGE_ID">OH_FILEPERM_NAME_NT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Oracle Home File Permission (Windows)</col>
  </row>
  
  
 <row>
    <col name="MESSAGE_ID">OH_FILEPERM_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that all files in the ORACLE_HOME directories (except for ORACLE_HOME/bin) do not have public read, write and  execute permissions</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_FILEPERM_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Incorrect file permissions on some of the Oracle files can cause major security issues.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OH_FILEPERM_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict permissions to all files in the ORACLE_HOME directories (except for ORACLE_HOME/bin) to the owner of the Oracle software set and DBA group. Do not give read, write, and execute permissions to public.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">LOG_ARCH_DEST_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Log Archive Destination Permission</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">LOG_ARCH_DEST_NAME_NT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Log Archive Destination Permission (Windows)</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">LOG_ARCH_DEST_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that the server's archive logs are not accessible to public</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">LOG_ARCH_DEST_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">LogMiner can be used to extract database information from the archive logs if the directory specified by LOG_ARCHIVE_DEST parameter (in init.ora file) is not owned by the owner of the Oracle software installation or has permissions for others.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">LOG_ARCH_DEST_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Permissions of the directory specified by LOG_ARCHIVE_DEST parameter should be restricted to the owner of the Oracle software set and DBA group with no permissions to public.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">LOG_ARCH_DEST_OWNER_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Log Archive Destination Owner</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">LOG_ARCH_DEST_OWNER_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that the server's archive logs directory is a valid directory owned by Oracle software owner</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">LOG_ARCH_DEST_OWNER_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">LogMiner can be used to extract database information from the archive logs if the directory specified by LOG_ARCHIVE_DEST parameter (in init.ora file) is not owned by the owner of the Oracle software installation or has permissions for others.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">LOG_ARCH_DEST_OWNER_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Directory specified by LOG_ARCHIVE_DEST parameter should be owned by the Oracle software set.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">LOG_ARCHV_DUP_PERM_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Log Archive Duplex Destination Permission</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">LOG_ARCHV_DUP_PERM_NAME_NT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Log Archive Duplex Destination Permission (Windows)</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">LOG_ARCHV_DUP_PERM_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that the server's archive logs are not accessible to public</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">LOG_ARCHV_DUP_PERM_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">LogMiner can be used to extract database information from the archive logs if the directory specified by LOG_ARCHIVE_DUPLEX_DEST parameter (in init.ora file) is not owned by the owner of the Oracle software installation or has permissions for others.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">LOG_ARCHV_DUP_PERM_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Permissions of the directory specified by LOG_ARCHIVE_DUPLEX_DEST parameter should be restricted to the owner of the Oracle software set and DBA group with no permissions to public. </col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">LOG_ARCHV_DUP_OWNER_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Log Archive Duplex Destination Owner</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">LOG_ARCHV_DUP_OWNER_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that the server's archive logs directory is a valid directory owned by Oracle software owner</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">LOG_ARCHV_DUP_OWNER_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">LogMiner can be used to extract database information from the archive logs if the directory specified by LOG_ARCHIVE_DUPLEX_DEST parameter (in init.ora file) is not owned by the owner of the Oracle software installation or has permissions for others.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">LOG_ARCHV_DUP_OWNER_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Directory specified by LOG_ARCHIVE_DUPLEX_DEST parameter should be owned by the Oracle software set.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">LOG_ARCHIVE_START_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Use of Automatic Log Archival Features</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">LOG_ARCHIVE_START_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that archiving of redo logs is done automatically and prevents suspension of instance operations when redo logs fill. Only applicable if database is in archivelog mode</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">LOG_ARCHIVE_START_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Setting the LOG_ARCHIVE_START initialization parameter to TRUE ensures that the archiving of redo logs is done automatically and prevents suspension of instance operations when redo logs fill. This feature is only applicable if the database is in archivelog mode.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">LOG_ARCHIVE_START_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Set LOG_ARCHIVE_START initialization parameter to TRUE.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">UTL_FILE_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Utility File Directory Initialization Parameter Setting</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">UTL_FILE_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that the Utility File Directory  (UTL_FILE_DIR) initialization parameter  is not set to one of '*', '.', core dump trace file locations</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">UTL_FILE_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Specifies the directories which the UTL_FILE package can access. Having the parameter set to asterisk (*),  period (.), or to sensitive directories, could expose them to all users having execute privilege on the UTL_FILE package.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">UTL_FILE_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Change the UTL_FILE_DIR initialization parameter to a value other than asterisk (*),  or period (.), or  to core dump trace locations.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">UTL_FILE_9IPLUS_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Utility File Directory Initialization Parameter Setting in Oracle9i Release 1 and Later</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">UTL_FILE_9IPLUS_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensure that the UTL_FILE_DIR initialization parameter is not used in Oracle9i Release 1 and later</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">UTL_FILE_9IPLUS_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Specifies the directories which UTL_FILE package can access. Having the parameter set to asterisk (*),  period (.), or to sensitive directories could expose them to all users having execute privilege on UTL_FILE package.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">UTL_FILE_9IPLUS_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">For Oracle 9i Release 1 and later, remove the UTL_FILE_DIR initialization parameter. Instead, use the CREATE DIRECTORY feature.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">OS_AUTH_PRFX_DOM_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Use of Windows NT Domain Prefix</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OS_AUTH_PRFX_DOM_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures externally identified users specify the domain while connecting</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OS_AUTH_PRFX_DOM_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">This setting is only applicable to Windows systems. If externally identified accounts are required, setting OSAUTH_PREFIX_DOMAIN to TRUE in the registry forces the account to specify the domain. This prevents spoofing of user access from an alternate domain or local system.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OS_AUTH_PRFX_DOM_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">For externally identified users from Windows systems, set the OSAUTH_PREFIX_DOMAIN initialization parameter to TRUE.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">PWD_LOCK_TIME_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Password Locking Time</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PWD_LOCK_TIME_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures PASSWORD_LOCK_TIME is set to a reasonable number of days for all profiles</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PWD_LOCK_TIME_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Having a low value increases the likelihood of Denial of Service attacks.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PWD_LOCK_TIME_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Set the PASSWORD_LOCK_TIME parameter to no less than 1 for all the profiles.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">MIN_PWD_LOCK_TIME_PNAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">MIN_PASSWORD_LOCK_TIME</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">PWD_GRACE_TIME_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Password Grace Time</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PWD_GRACE_TIME_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that all profiles have PASSWORD_GRACE_TIME set to a reasonable number of days</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PWD_GRACE_TIME_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">A high value for the PASSWORD_GRACE_TIME parameter may cause serious database security issues by allowing the user to keep the same password for a long time.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PWD_GRACE_TIME_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Set the PASSWORD_GRACE_TIME parameter to no more  than 7 days for all profiles.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">MAX_PWD_GRACE_TIME_PNAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">MAX_PASSWORD_GRACE_TIME</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">PWD_LIFE_TIME_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Password Life Time</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PWD_LIFE_TIME_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that all profiles have PASSWORD_LIFE_TIME set to a reasonable number of days</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PWD_LIFE_TIME_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">A long password life time gives hackers a long time to try and cook the password. May cause serious database security issues.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PWD_LIFE_TIME_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Set the PASSWORD_LIFE_TIME parameter to no more than 180 days for all profiles.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">MAX_PWD_LIFE_TIME_PNAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">MAX_PASSWORD_LIFE_TIME</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">PWD_REUSE_MAX_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Password Reuse Max</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PWD_REUSE_MAX_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that all profiles have PASSWORD_REUSE_MAX set to a reasonable number of times</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PWD_REUSE_MAX_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Old passwords are usually the best guesses for the current  password. A low value for the PASSWORD_REUSE_MAX parameter may cause serious database security issues by allowing users to reuse their old passwords more often.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PWD_REUSE_MAX_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Set the PASSWORD_REUSE_MAX parameter to UNLIMITED for all profiles.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">MIN_PWD_REUSE_MAX_PNAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">MIN_PASSWORD_REUSE_MAX</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">PWD_REUSE_TIME_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Password Reuse Time</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PWD_REUSE_TIME_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that all profiles have PASSWORD_REUSE_TIME set to a reasonable number of days</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PWD_REUSE_TIME_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">A low value for the PASSWORD_REUSE_TIME parameter may cause serious database security issues by allowing users to reuse their old passwords more often.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PWD_REUSE_TIME_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Set the PASSWORD_REUSE_TIME parameter to UNLIMITED for all profiles.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">MIN_PWD_REUSE_TIME_PNAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">MIN_PASSWORD_REUSE_TIME</col>
  </row>

<row>
    <col name="MESSAGE_ID">PWD_CMPLX_FN_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Password Complexity Verification Function Usage</col>
 </row>
  
 <row>
    <col name="MESSAGE_ID">PWD_CMPLX_FN_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures PASSWORD_VERIFY_FUNCTION resource for the profile is set</col>
 </row>
  
 <row>
    <col name="MESSAGE_ID">PWD_CMPLX_FN_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Having passwords that do not meet minimum complexity requirements offer substantially less protection than complex passwords.</col>
 </row>
  
 <row>
    <col name="MESSAGE_ID">PWD_CMPLX_FN_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Set the PASSWORD_VERIFY_FUNCTION resource of the profile.</col>
 </row>

 <row>
    <col name="MESSAGE_ID">TRACE_FILES_PUB_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Public Trace Files</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">TRACE_FILES_PUBLIC_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures database trace files are not public readable</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">TRACE_FILES_PUBLIC_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">If trace files are readable by the PUBLIC group, a malicious user may attempt to read the trace files that could lead to sensitive information being exposed.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">TRACE_FILES_PUBLIC_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Set the initialization parameter _TRACE_FILES_PUBLIC to FALSE.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">AUDIT_TRAIL_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Enable Database Auditing</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">AUDIT_TRAIL_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures database auditing is enabled</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">AUDIT_TRAIL_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">The AUDIT_TRAIL parameter enables or disables database auditing. Auditing enhances security because it enforces accountability, provides evidence of misuse, and is frequently required for regulatory compliance. Auditing also enables system administrators to implement enhanced protections, early detection of suspicious activities, and finely-tuned security responses.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">AUDIT_TRAIL_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Set AUDIT_TRAIL to either DB, default, or OS. Database-stored audit records can be easier to review and manage than OS-stored audit records. However, audit records stored in operating system files can be protected from DBAs via appropriate file permissions, and will remain available even if the database is temporarily inaccessible.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">RMT_LSNR_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Use of Remote Listener Instances</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">RMT_LSNR_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures listener instances on a remote machine separate from the database instance are not used</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">RMT_LSNR_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">The REMOTE_LISTENER initialization parameter can be used to allow a listener on a remote machine to access the database. This parameter is not applicable in a multi-master replication or RAC environment where this setting provides a load balancing mechanism for the listener.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">RMT_LSNR_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">REMOTE_LISTENER should be set null string. This parameter is not applicable in a multi-master replication or RAC environment where this setting provides a load balancing mechanism for the listener.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">OS_AUTH_PREFIX_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Using Externally Identified Accounts</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OS_AUTH_PREFIX_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that the OS authentication prefix is set to a value other than OPS$</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OS_AUTH_PREFIX_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">The OS_AUTHENT_PREFIX parameter specifies a prefix used to authenticate users attempting to connect to the server. When a connection request is attempted, Oracle compares the prefixed username with usernames in the database.  Using a prefix, especially OPS$, tends to result in an insecure configuration as an account can be authenticated either as an operating system user or with the password used in the IDENTIFIED BY clause. Attackers are aware of this and will attack these accounts.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">OS_AUTH_PREFIX_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Set OS_AUTHENT_PREFIX to a value other than OPS$.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">SQL92_SECURITY_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Use of SQL92 Security Features</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">SQL92_SECURITY_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures use of SQL92 security features</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">SQL92_SECURITY_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">If SQL92 security features are not enabled, a user might be able to execute an UPDATE or DELETE statement using a WHERE clause without having select privilege on a table.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">SQL92_SECURITY_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Enable SQL92 security features by setting the initialization parameter SQL92_SECURITY to TRUE.</col>
  </row>

<row>
    <col name="MESSAGE_ID">GLOBAL_NAME_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Naming Database Links</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">GLOBAL_NAME_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures that the name of a database link is the same as that of the remote database</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">GLOBAL_NAME_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Database link names that do not match the global names of the databases to which they are connecting can cause an administrator to inadvertently give access to a production server from a test or development server. Knowledge of this can be used by a malicious user to gain access to the target database.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">GLOBAL_NAME_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">If you use or plan to use distributed processing, Oracle Corporation recommends that you set the GLOBAL_NAMES initialization parameter to TRUE to ensure the use of consistent naming conventions for databases and links in a networked environment.</col>
  </row>

<row>
    <col name="MESSAGE_ID">DB_LINK_WITH_PWD_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Use of Database Links with Cleartext Password</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">DB_LINK_WITH_PWD_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures database links with clear text passwords are not used</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">DB_LINK_WITH_PWD_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">The table SYS.LINK$ contains the clear text password used by the database link. A malicious user can read clear text password from SYS.LINK$ table that can lead to undesirable consequences.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">DB_LINK_WITH_PWD_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Avoid creating fixed user database links.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">UMASK_SETTING_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Use of Appropriate Umask on UNIX Systems</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">UMASK_SETTING_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">On UNIX systems, ensure that the owner of the Oracle software has an appropriate umask value of 022 set</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">UMASK_SETTING_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">If umask is not set to an appropriate value (like 022), log or trace files might become accessible to public exposing sensitive information.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">UMASK_SETTING_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Set umask to 022 for the owner of Oracle software.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">UNLMT_FAILED_LGIN_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Users with Excessive Allowed Failed Login Attempts</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PROFILE_UNLMTED_FAILED_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Profiles with Excessive Allowed Failed Login Attempts</col>
  </row>

<row>
    <col name="MESSAGE_ID">UNLMT_FAILED_LGIN_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensure that the number of allowed failed login attempts is set to a reasonable number of login attempts for all profiles</col>
  </row>

<row>
    <col name="MESSAGE_ID">USR_UNLMT_FAILED_LGIN_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensure that the number of allowed failed login attempts is set to a reasonable number of login attempts for all users</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">UNLMT_FAILED_LGIN_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Permits manual and automated password guessing by a malicious user.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">UNLMT_FAILED_LGIN_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Set FAILED_LOGIN_ATTEMPTS in user profiles to no more than 10.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">MAX_FAILED_LOGIN_ATTEMPTS_PNAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">MAX_FAILED_LOGIN_ATTEMPTS</col>
  </row>
  
  
    

 <row>
    <col name="MESSAGE_ID">UTL_TCP_PUB_EXE_PRIV_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restricted Privilege to Execute UTL_TCP</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">UTL_TCP_PUB_EXE_PRIV_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensure PUBLIC does not have execute privileges on the UTL_TCP package</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PUB_EXE_PRIV_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Privileges granted to the PUBLIC role automatically apply to all users. A  malicious user can gain access to email, network and http modules using the EXECUTE privilege.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">UTL_TCP_PUB_EXE_PRIV_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Revoke EXECUTE privileges on the UTL_TCP package.</col>
</row>

<row>
    <col name="MESSAGE_ID">UTL_HTTP_PUB_EXE_PRIV_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restricted Privilege to Execute UTL_HTTP</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">UTL_HTTP_PUB_EXE_PRIV_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensure PUBLIC does not have execute privileges on the UTL_HTTP package</col>
  </row>
   
 <row>
    <col name="MESSAGE_ID">UTL_HTTP_PUB_EXE_PRIV_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Revoke EXECUTE privileges on the UTL_HTTP package.</col>
</row>

<row>
    <col name="MESSAGE_ID">UTL_SMTP_PUB_EXE_PRIV_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restricted Privilege to Execute UTL_SMTP</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">UTL_SMTP_PUB_EXE_PRIV_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensure PUBLIC does not have execute privileges on the UTL_SMTP package</col>
  </row>
   
 <row>
    <col name="MESSAGE_ID">UTL_SMTP_PUB_EXE_PRIV_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Revoke EXECUTE privileges on the UTL_SMTP package.</col>
</row>

<row>
    <col name="MESSAGE_ID">UTL_FILE_PKG_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Execute Privileges on UTL_FILE To PUBLIC</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">UTL_FILE_PKG_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensure PUBLIC does not have EXECUTE privilege on the UTL_FILE package</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">UTL_FILE_PKG_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Privileges granted to the PUBLIC role automatically apply to all users. A  malicious user can read and write arbitrary files in the system when granted  the UTL_FILE privilege.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">UTL_FILE_PKG_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Revoke EXECUTE privileges granted  to UTL_FILE package from  PUBLIC.</col>
  </row>

<row>
    <col name="MESSAGE_ID">DBMS_JOB_PKG_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Execute Privileges on DBMS_JOB to PUBLIC</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">DBMS_JOB_PKG_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures PUBLIC is not granted EXECUTE privileges on DBMS_JOB package</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">DBMS_JOB_PKG_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Granting EXECUTE privilege to PUBLIC on DBMS_JOB package allows users to schedule jobs on the database.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">DBMS_JOB_PKG_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">PUBLIC must not be granted EXECUTE privileges on  DBMS_JOB package.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">DBMS_SYS_SQL_PKG_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Execute Privileges on DBMS_SYS_SQL to PUBLIC</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">DBMS_SYS_SQL_PKG_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures PUBLIC is not granted EXECUTE privileges on DBMS_SYS_SQL package</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">DBMS_SYS_SQL_PKG_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">The DBMS_SYS_SQL package can be used to run PL/SQL and SQL as the owner of the procedure rather than the caller.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">DBMS_SYS_SQL_PKG_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Revoke the EXECUTE privileges on DBMS_SYS_SQL package from the PUBLIC group.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">DBMS_LOB_PKG_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Execute Privileges on DBMS_LOB to PUBLIC</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">DBMS_LOB_PKG_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures PUBLIC group is not granted EXECUTE privileges to the DBMS_LOB package</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">DBMS_LOB_PKG_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">The DBMS_LOB package can be used to access any file on the system as the owner of the Oracle software installation.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">DBMS_LOB_PKG_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Revoke the EXECUTE privileges on DBMS_LOB package from the PUBLIC group.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">PUB_SYSPRIV_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">System Privileges to Public</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PUB_SYSPRIV_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensure system privileges are not granted to PUBLIC</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PUB_SYSPRIV_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Privileges granted to the public role automatically apply to all users. there are security risks granting SYSTEM privileges to all
users.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">PUB_SYSPRIV_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Revoke SYSTEM privileges from public.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">DFLT_ACT_PWD_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Default Passwords</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">DFLT_ACT_PWD_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensure there are no default passwords for known accounts</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">DFLT_ACT_PWD_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">A malicious user can gain access to the database using default passwords.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">DFLT_ACT_PWD_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">All default passwords should be changed.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">WELL_KNOWN_ACCOUNT1_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Well Known Accounts (Status)</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">WELL_KNOWN_ACCOUNT2_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Well Known Accounts</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">WELL_KNOWN_ACCOUNT_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensure well-known accounts are expired and locked</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">WELL_KNOWN_ACCOUNT_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">A knowledgeable malicious user can gain access to the database using a well-known account.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">WELL_KNOWN_ACCOUNT_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Expire and lock well-known accounts.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">RMT_LGIN_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Remote Password File</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">RMT_LGIN_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures privileged users are authenticated by the operating system; that is, Oracle ignores any password file</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">RMT_LGIN_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">The REMOTE_LOGIN_PASSWORDFILE parameter specifies whether or not Oracle checks for a password file. Because password files contain the passwords for users, including SYS, the most secure way of preventing an attacker from connecting through brute-force password-related attacks is to require privileged users be authenticated by the operating system.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">RMT_LGIN_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Remove the password file and to set REMOTE_LOGIN_PASSWORDFILE to NONE.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">RMT_ROLE_AUTH_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Remote OS Authentication</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">RMT_ROLE_AUTH_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensure REMOTE_OS_AUTHENT initialization parameter is set to FALSE</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">RMT_ROLE_AUTH_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">A malicious user can gain access to the database if remote OS authentication is allowed.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">RMT_ROLE_AUTH_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Set the REMOTE_OS_AUTHENT initialization parameter to FALSE.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">RMT_OS_ROLE_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Remote OS Role</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">RMT_OS_ROLE_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensure REMOTE_OS_ROLES initialization parameter is set to FALSE</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">RMT_OS_ROLE_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">A malicious user can gain access to the database if remote users can be granted privileged roles.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">RMT_OS_ROLE_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Set the REMOTE_OS_ROLES initialization parameter to FALSE.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">USR_ACCSS_AUD_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Access to SYS.AUD$ Table</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">USR_ACCSS_AUD_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures restricted access to SYS.AUD$ table</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">USR_ACCSS_AUD_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">A knowlegeable and malicious user can gain access to sensitive audit information.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">USR_ACCSS_AUD_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Revoke access to SYS.AUD$ table from the non-DBA/SYS database users.</col>
  </row>

<row>
    <col name="MESSAGE_ID">ACCESS_USER_HIST_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Access to SYS.USER_HISTORY$ Table</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCESS_USER_HIST_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures restricted access to SYS.USER_HISTORY$ table</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCESS_USER_HIST_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Username and password hash may be read from the SYS.USER_HISTORY$ table, enabling a hacker to launch a brute-force attack.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCESS_USER_HIST_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Revoke access to SYS.USER_HISTORY$ table from the non-DBA/SYS database users.</col>
  </row>

<row>
    <col name="MESSAGE_ID">ACSS_SRC_TAB_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Access to SYS.SOURCE$ Table</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACSS_SRC_TAB_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures restricted access to SYS.SOURCE$ table</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACSS_SRC_TAB_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Contains source of all stored packages units in the database.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACSS_SRC_TAB_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Revoke access to SYS.SOURCE$ table from the non-SYS/DBA database users.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">ACCSS_LINK_TAB_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Access to SYS.LINK$ Table</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_LINK_TAB_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures restricted access to LINK$ table</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_LINK_TAB_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">A knowlegeable and malicious user can gain access to user passwords from the SYS.LINK$ table.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_LINK_TAB_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict access to SYS.LINK$ table.</col>
  </row>

<row>
    <col name="MESSAGE_ID">ACCSS_USER_TAB_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Access to SYS.USER$ Table</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_USER_TAB_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures restricted access to SYS.USER$ table</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_USER_TAB_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Username and password hash may be read from the SYS.USER$ table, enabling a hacker to launch a brute-force attack.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_USER_TAB_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict access to SYS.USER$ table.</col>
  </row>

<row>
    <col name="MESSAGE_ID">ACCSS_SQLTEXT_TAB_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Access to STATS$SQLTEXT Table</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_SQLTEXT_TAB_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures restricted access to STATS$SQLTEXT table</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_SQLTEXT_TAB_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">This table provides full text of the recently-executed SQL statements. The SQL statements can reveal sensitive information.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_SQLTEXT_TAB_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict access to STATS$SQLTEXT table.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">ACCSS_SQLSUM_TAB_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Access to STATS$SQL_SUMMARY Table</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_SQLSUM_TAB_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures restricted access to STATS$SQL_SUMMARY table</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_SQLSUM_TAB_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Contains first few lines of SQL text of the most resource intensive commands given to the server. Sql statements executed without bind variables can show up here exposing privileged information.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_SQLSUM_TAB_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict access to STATS$SQL_SUMMARY table.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">ACCSS_ALL_SRC_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Access to ALL_SOURCE View</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_ALL_SRC_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures restricted access to ALL_SOURCE view</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_ALL_SRC_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">ALL_SOURCE view contains source of all stored packages in the database.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_ALL_SRC_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Revoke access to ALL_SOURCE view from the non-SYS database users.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_ROLES_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Access to DBA_ROLES View</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_ROLES_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures restricted access to DBA_ROLES view</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_ROLES_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">DBA_ROLES view contains details of all roles in the database. Knowledge of the structure of roles in the database can be taken advantage of by a malicious user.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_ROLES_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict access to DBA_ROLES view.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_SYSPRIVS_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Access to DBA_SYS_PRIVS View</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_SYSPRIVS_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures restricted access to DBA_SYS_PRIVS view</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_SYSPRIVS_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">DBA_SYS_PRIVS view can be queried to find system privileges granted to roles and users. Knowledge of the structure of roles in the database can be taken advantage of by a malicious user.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_SYSPRIVS_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict access to DBA_SYS_PRIVS view.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_ROLEPRIVS_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Access to DBA_ROLE_PRIVS View</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_ROLEPRIVS_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures restricted access to DBA_ROLE_PRIVS view</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_ROLEPRIVS_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">The DBA_ROLE_PRIVS view lists the roles granted to users and other roles. Knowledge of the structure of roles in the database can be taken advantage of by a malicious user.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_ROLEPRIVS_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict access to DBA_ROLE_PRIVS view.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_TABPRIVS_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Access to DBA_TAB_PRIVS View</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_TABPRIVS_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures restricted access to DBA_TAB_PRIVS view</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_TABPRIVS_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Lists privileges granted to users or roles on objects in the database. Knowledge of the structure of roles in the database can be taken advantage of by a malicious user.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_TABPRIVS_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict access to DBA_TAB_PRIVS view.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_USERS_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Access to DBA_USERS View</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_USERS_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures restricted access to DBA_USERS view</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_USERS_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Contains user password hashes and other account information. Access to this information can be used to mount brute-force attacks.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_DBA_USERS_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict access to DBA_USERS view.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">ACCSS_ROLE_ROLE_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Access to ROLE_ROLE_PRIVS View</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_ROLE_ROLE_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures restricted access to ROLE_ROLE_PRIVS view</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_ROLE_ROLE_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Lists roles granted to other roles. Knowledge of the structure of roles in the database can be taken advantage of by a malicious user.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_ROLE_ROLE_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict access to ROLE_ROLE_PRIVS view.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">ACCSS_USER_TAB_PRIVS_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Access to USER_TAB_PRIVS View</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_USER_TAB_PRIVS_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures restricted access to USER_TAB_PRIVS view</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_USER_TAB_PRIVS_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Lists the grants on objects for which the user is the owner, grantor or grantee. Knowledge of the grants in the database can be taken advantage of by a malicious user.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_USER_TAB_PRIVS_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict access to USER_TAB_PRIVS view.</col>
  </row>
  

 <row>
    <col name="MESSAGE_ID">ACCSS_USER_ROLE_PRIV_NAME</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Access to USER_ROLE_PRIVS View</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_USER_ROLE_PRIV_DESC</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Ensures restricted access to USER_ROLE_PRIVS view</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_USER_ROLE_PRIV_IMPACT</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Lists the roles granted to the current user. Knowledge of the structure of roles in the database can be taken advantage of by a malicious user.</col>
  </row>
  
 <row>
    <col name="MESSAGE_ID">ACCSS_USER_ROLE_PRIV_RECOMM</col>
    <col name="SUBSYSTEM">POLICY</col>
    <col name="MESSAGE">Restrict access to USER_ROLE_PRIVS view.</col>
  </row>

<row>
   <col name="MESSAGE_ID">SECURE_OS_AUDIT_LEVEL_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Secure Os Audit Level</col>
 </row>

<row>
   <col name="MESSAGE_ID">SECURE_OS_AUDIT_LEVEL_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">On UNIX systems, ensures that AUDIT_SYSLOG_LEVEL is set to a non-default value when OS-level auditing is enabled</col>
 </row>

<row>
   <col name="MESSAGE_ID">SECURE_OS_AUDIT_LEVEL_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Setting the AUDIT_SYSLOG_LEVEL initialization parameter to the default value (NONE) will result in DBAs gaining access to the OS audit records.</col>
 </row>

<row>
   <col name="MESSAGE_ID">SECURE_OS_AUDIT_LEVEL_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">When operating system auditing is enabled, set the AUDIT_SYSLOG_LEVEL initialization parameter to a valid value and configure /etc/syslog.conf so that Oracle OS audit records are written to a seperate file.</col>
 </row>
 

 <row>
   <col name="MESSAGE_ID">DATA_DICTIONARY_PROTECTED_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Data Dictionary Protected</col>
 </row>

<row>
   <col name="MESSAGE_ID">DATA_DICTIONARY_PROTECTED_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures data dictionary protection is enabled</col>
 </row>

<row>
   <col name="MESSAGE_ID">DATA_DICTIONARY_PROTECTED_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The 07_DICTIONARY_ACCESSIBILITY parameter controls access to the data dictionary. Setting the 07_DICTIONARY_ACCESSIBILITY to TRUE allows users with ANY system privileges to access the data dictionary.  As a result, these user accounts can be exploited to gain unauthorized access to data.</col>
 </row>  
   
 <row>
   <col name="MESSAGE_ID">DATA_DICTIONARY_PROTECTED_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Set 07_DICTIONARY_ACCESSIBILITY to FALSE.</col>
 </row>

<row>
   <col name="MESSAGE_ID">AUDIT_SYS_OPS_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Auditing of SYS Operations Enabled</col>
 </row>

<row>
   <col name="MESSAGE_ID">AUDIT_SYS_OPS_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures sessions for users who connect as SYS are fully audited</col>
 </row>

<row>
   <col name="MESSAGE_ID">AUDIT_SYS_OPS_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The AUDIT_SYS_OPERATIONS parameter enables or disables the auditing of operations issued by user SYS, and users connecting with SYSDBA or SYSOPER privileges.</col>
 </row>
   
 <row>
   <col name="MESSAGE_ID">AUDIT_SYS_OPS_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Set AUDIT_SYS_OPERATIONS to TRUE.</col>
 </row>

<row>
   <col name="MESSAGE_ID">PROXY_ACCOUNT_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Proxy Account</col>
 </row>

<row>
   <col name="MESSAGE_ID">PROXY_ACCOUNT_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures that the proxy accounts have limited privileges</col>
 </row>

<row>
   <col name="MESSAGE_ID">PROXY_ACCOUNT_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The proxy user only needs to connect to the database. Once connected it will use the privileges of the user it is connecting on behalf of. Granting any other privilege than the CREATE SESSION privilege to the proxy user is unnecessary and open to misuse.</col>
 </row>

<row>
   <col name="MESSAGE_ID">PROXY_ACCOUNT_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Limit the privileges of the proxy accounts to CREATE SESSION.</col>
 </row>

<row>
   <col name="MESSAGE_ID">RBS_IN_SYSTEM_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Rollback in SYSTEM Tablespace</col>
 </row>

<row>
   <col name="MESSAGE_ID">RBS_IN_SYSTEM_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks for rollback segments in SYSTEM tablespace</col>
 </row>

<row>
   <col name="MESSAGE_ID">RBS_IN_SYSTEM_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The SYSTEM tablespace should be reserved only for the Oracle data dictionary and its associated objects. It should NOT be used to store any other types of objects such as user tables, user indexes, user views, rollback segments, undo segments or temporary segments.</col>
 </row>

<row>
   <col name="MESSAGE_ID">RBS_IN_SYSTEM_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Use a tablespace dedicated to undo instead of the SYSTEM tablespace.</col>
 </row>

<row>
   <col name="MESSAGE_ID">RBS_TBSP_TR_NLSID</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Rollback Segment Tablespace Name</col>
 </row>

<row>
   <col name="MESSAGE_ID">PERM_AS_TEMP_TBSP_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Users with Permanent Tablespace as Temporary Tablespace</col>
 </row>

<row>
   <col name="MESSAGE_ID">PERM_AS_TEMP_TBSP_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks for users using a permanent tablespace as the temporary tablespace</col>
 </row>

<row>
   <col name="MESSAGE_ID">PERM_AS_TEMP_TBSP_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">These users use a permanent tablespace as the temporary tablespace. Using temporary tablespaces allows space management for sort operations to be more efficient. Using a permanent tablespace for these operations may result in performance degradation, especially for Real Application Clusters.  If the user is using a system tablespace as the temporary tablespace, there is an additional security concern. This makes it possible for users to use all available space in the system tablespace, causing the database to stop working.</col>
 </row>

<row>
   <col name="MESSAGE_ID">PERM_AS_TEMP_TBSP_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Change the temporary tablespace for these users to specify a tablespace of type TEMPORARY.</col>
 </row>

<row>
   <col name="MESSAGE_ID">SYSTEM_AS_DEFAULT_TBSP_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Non-System Users with System Tablespace as Default Tablespace</col>
 </row>

<row>
   <col name="MESSAGE_ID">SYSTEM_AS_DEFAULT_TBSP_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks for non-system users using SYSTEM or SYSAUX as the default tablespace</col>
 </row>

<row>
   <col name="MESSAGE_ID">SYSTEM_AS_DEFAULT_TBSP_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">These non-system users use a system tablespace as the default tablespace. This violation will result in non-system data segments being added to the system tablespace, making it more difficult to manage these data segments and possibly resulting in performance degradation in the system tablespace.  This is also a security issue.  All Available space in the system tablespace may be consumed, thus causing the database to stop working.</col>
 </row>

<row>
   <col name="MESSAGE_ID">SYSTEM_AS_DEFAULT_TBSP_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Change the default tablespace for these users to specify a non-system tablespace.</col>
 </row>

<row>
   <col name="MESSAGE_ID">TBSP_SEGSPACE_MGMT_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Tablespace Not Using Automatic Segment-Space Management</col>
 </row>

<row>
   <col name="MESSAGE_ID">TBSP_SEGSPACE_MGMT_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks for locally managed tablespaces that are using MANUAL segment space management. The SYSTEM and SYSAUX tablespace are excluded from this check.</col>
 </row>

<row>
   <col name="MESSAGE_ID">TBSP_SEGSPACE_MGMT_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Automatic segment-space management is a simpler and more efficient way of managing space within a segment.  It completely eliminates any need to specify and tune the PCTUSED, FREELISTS and FREELIST GROUPS storage parameters for schema objects created in the tablespace.   In a RAC environment there is the additional benefit of avoiding the hard partitioning of space inherent with using free list groups.</col>
 </row>

<row>
   <col name="MESSAGE_ID">TBSP_SEGSPACE_MGMT_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle recommends changing MANUAL segment-space management settings of all permanent locally managed tablespaces to AUTO.  The tablespace must be reorganized to change this setting.</col>
 </row>

<row>
   <col name="MESSAGE_ID">TBSP_DICTIONARY_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Dictionary Managed Tablespaces</col>
 </row>

<row>
   <col name="MESSAGE_ID">TBSP_DICTIONARY_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks for dictionary managed tablespaces</col>
 </row>

<row>
   <col name="MESSAGE_ID">TBSP_DICTIONARY_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">These tablespaces are dictionary managed. Oracle recommends using locally managed tablespaces, with AUTO segment-space management, to enhance performance and ease of space management.</col>
 </row>

<row>
   <col name="MESSAGE_ID">TBSP_DICTIONARY_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Redefine these tablespaces to be locally managed.</col>
 </row>

<row>
   <col name="MESSAGE_ID">TBSP_MIXED_SEGS_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Tablespaces Containing Rollback and Data Segments</col>
 </row>

<row>
   <col name="MESSAGE_ID">TBSP_MIXED_SEGS_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks for tablespaces containing both rollback and data segments</col>
 </row>

<row>
   <col name="MESSAGE_ID">TBSP_MIXED_SEGS_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">These tablespaces contain both rollback and data segments. Mixing segment types in this way makes it more difficult to manage space and may degrade performance in the tablespace. Use of a dedicated tablespace for rollback segments enhances availability and performance.</col>
 </row>

<row>
   <col name="MESSAGE_ID">TBSP_MIXED_SEGS_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Use Automatic Undo Management (in Oracle 9.0.1 or greater) and drop the rollback segments from this tablespace; or, create one or more tablespaces dedicated to rollback segments and drop the rollback segments from this tablespace; or, dedicate this tablespace to rollback segments and move the data segments to another tablespace.</col>
 </row>

<row>
   <col name="MESSAGE_ID">DEFAULT_TEMP_TBSP_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Default Temporary Tablespace Set to a System Tablespace</col>
 </row>

<row>
   <col name="MESSAGE_ID">DEFAULT_TEMP_TBSP_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks if the DEFAULT_TEMP_TABLESPACE database property is set to a system tablespace</col>
 </row>

<row>
   <col name="MESSAGE_ID">DEFAULT_TEMP_TBSP_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">If not specified explicitly, the DEFAULT_TEMP_TABLESPACE would default  to the SYSTEM tablespace.  This is not the recommended setting.  The default temporary tablespace is used as the temporary tablespace for any users that are not explicitly assigned a temporary tablespace.  If the database default temporary tablespace is set to a system tablespace, then any user that is not explicitly assigned a temporary tablespace uses the system tablespace as their temporary tablespace.  System tablespaces should not be used to store temporary data. Doing so may result in performance degradation for the database. This is also a security issue.  If non-system users are storing data in a system tablespace it is possible that all available space in the system tablespace may be consumed, thus causing the database to stop working.</col>
 </row>

<row>
   <col name="MESSAGE_ID">DEFAULT_TEMP_TBSP_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle strongly recommends setting the DEFAULT_TEMP_TABLESPACE to a non-system temporary tablespace.  In the 10g version of the database, the DEFAULT_TEMP_TABLESPACE can also be set to a temporary tablespace group. Create or edit a temporary tablespace, or temporary tablespace group, and set it to be the default temporary tablespace.</col>
 </row>

<row>
   <col name="MESSAGE_ID">DEFAULT_PERMANENT_TBSP_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Default Permanent Tablespace Set to a System Tablespace</col>
 </row>

<row>
   <col name="MESSAGE_ID">DEFAULT_PERMANENT_TBSP_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks if the DEFAULT_PERMANENT_TABLESPACE database property is set to a system tablespace</col>
 </row>

<row>
   <col name="MESSAGE_ID">DEFAULT_PERMANENT_TBSP_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">If not specified explicitly, the DEFAULT_PERMANENT_TABLESPACE is defaulted  to the SYSTEM tablespace.  This is not the recommended setting.  The default permanent tablespace for the database is used as the permanent tablespace for any non-system users that are not explicitly assigned a permanent tablespace.  If the database default permanent tablespace is set to a system tablespace, then any user that is not explicitly assigned a tablespace uses the system tablespace.  Non-system users should not be using a system tablespaces to store data.  Doing so may result in performance degradation for the database.  This is also a security issue.  If non-system users are storing data in a system tablespace it is possible that all available space in the system tablespace may be consumed, thus causing the database to stop working.</col>
 </row>

<row>
   <col name="MESSAGE_ID">DEFAULT_PERMANENT_TBSP_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle strongly recommends that you set the DEFAULT_PERMANENT_TABLESPACE to a non-system tablespace.  Select a different tablespace to be the DEFAULT_PERMANENT_TABLESPACE.  To do this, create or edit a tablespace and set it to be the default permanent tablespace.</col>
 </row>

<row>
   <col name="MESSAGE_ID">NO_UNDO_TBSP_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Not Using Automatic Undo Management</col>
 </row>

<row>
   <col name="MESSAGE_ID">NO_UNDO_TBSP_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks for automatic undo space management not being used</col>
 </row>

<row>
   <col name="MESSAGE_ID">NO_UNDO_TBSP_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Not using automatic undo management can cause unnecessary contention and performance issues in your database. This may include among other issues, contention for the rollback segment header blocks, in the form of buffer busy waits and increased probability of ORA-1555s (Snapshot Too Old).</col>
 </row>

<row>
   <col name="MESSAGE_ID">NO_UNDO_TBSP_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Use automatic undo space management instead of manual undo or rollback segments.</col>
 </row>

<row>
   <col name="MESSAGE_ID">NO_SPFILE_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Not Using Spfile</col>
 </row>

<row>
   <col name="MESSAGE_ID">NO_SPFILE_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks for spfile not being used</col>
 </row>

<row>
   <col name="MESSAGE_ID">NO_SPFILE_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The SPFILE (server parameter file) enables you persist any dynamic changes to the Oracle initialization parameters using ALTER SYSTEM commands. This persistence is provided across database shutdowns. When a database has an SPFILE configured, you don't have to remember to make the corresponding changes to the Oracle init.ora file. Plus, any changes that are made via ALTER SYSTEM commands are not lost after an shutdown and restart.</col>
 </row>

<row>
   <col name="MESSAGE_ID">NO_SPFILE_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Use server side parameter file to update changes dynamically.</col>
 </row>

<row>
   <col name="MESSAGE_ID">NON_UNIFORM_TBSP_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Non-uniform Default Extent Size for Tablespaces</col>
 </row>

<row>
   <col name="MESSAGE_ID">NON_UNIFORM_TBSP_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks for dictionary managed or migrated locally managed tablespaces with non-uniform default extent size</col>
 </row>

<row>
   <col name="MESSAGE_ID">NON_UNIFORM_TBSP_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Dictionary managed or migrated locally managed tablespaces using non-uniform default extent sizes have been found.  This means that the extents in a single tablespace will vary in size leading to fragmentation, inefficient space usage and performance degradation.</col>
 </row>

<row>
   <col name="MESSAGE_ID">NON_UNIFORM_TBSP_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">To ensure uniform extent sizes, set the storage attributes for each tablespace such that Next Size is equal to or a multiple of the Initial Size, and the Increment Size (%) is set to zero.  Do not explicitly specify storage attributes at the segment level.  Instead, let the storage values for the segments be inherited from the default storage attributes of the tablespace.</col>
 </row>

<row>
   <col name="MESSAGE_ID">SEG_NONSYS_SEG_IN_SYS_TS_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Non-System Data Segments in System Tablespaces</col>
 </row>

<row>
   <col name="MESSAGE_ID">SEG_NONSYS_SEG_IN_SYS_TS_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks for data segments owned by non-system users located in tablespaces SYSTEM and SYSAUX</col>
 </row>

<row>
   <col name="MESSAGE_ID">SEG_NONSYS_SEG_IN_SYS_TS_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">These segments belonging to non-system users are stored in system tablespaces SYSTEM or SYSAUX.  This violation makes it more difficult to manage these data segments and may result in performance degradation in the system tablespace.  This is also a security issue.  If non-system users are storing data in a system tablespace it is possible that all available space in the system tablespace may be consumed, thus causing the database to stop working.  System users include users that are part of the DBMS such as SYS and SYSTEM, or that are part of Oracle-supplied facilities: for example, CTXSYS, SYSMAN, and OLAPSYS.</col>
 </row>

<row>
   <col name="MESSAGE_ID">SEG_NONSYS_SEG_IN_SYS_TS_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Relocate the non-system segments to a non-system tablespace.</col>
 </row>

<row>
   <col name="MESSAGE_ID">SEG_EXT_GROWTH_VIO_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Segment with Extent Growth Policy Violation</col>
 </row>

<row>
   <col name="MESSAGE_ID">SEG_EXT_GROWTH_VIO_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks for segments in dictionary managed or migrated locally managed tablespaces having irregular extent sizes and/or non-zero Percent Increase settings</col>
 </row>

<row>
   <col name="MESSAGE_ID">SEG_EXT_GROWTH_VIO_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">These segments have extents with sizes that are not multiples of the initial extent or have a non-zero Percent Increase setting. This can result in inefficient reuse of space and fragmentation problems.</col>
 </row>

<row>
   <col name="MESSAGE_ID">SEG_EXT_GROWTH_VIO_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Implement either of these two recommendations: 1) Create a locally managed tablespace and reorganize these segments into it.  2) Or, reorganize these segments, specifying a Next Extent value that is a multiple of Initial Extent, and a Percent Increase value of 0.</col>
 </row>

<row>
   <col name="MESSAGE_ID">HIDDEN_PARAMS_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Use of Non-Standard Initialization Parameters</col>
 </row>

<row>
   <col name="MESSAGE_ID">HIDDEN_PARAMS_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks for use of non-standard initialization parameters</col>
 </row>

<row>
   <col name="MESSAGE_ID">HIDDEN_PARAMS_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Non-standard initialization parameters are being used.  These may have been implemented based on poor advice or incorrect assumptions.  In particular, parameters associated with SPIN_COUNT on latches and undocumented optimizer features can cause a great deal of problems that can require considerable investigation.</col>
 </row>

<row>
   <col name="MESSAGE_ID">HIDDEN_PARAMS_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Avoid use of non-standard initialization parameters.</col>
 </row>

<row>
   <col name="MESSAGE_ID">STATISTICS_LEVEL_HIGH_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">STATISTICS_LEVEL Parameter Set to ALL</col>
 </row>

<row>
   <col name="MESSAGE_ID">STATISTICS_LEVEL_HIGH_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks if the STATISTICS_LEVEL initialization parameter is set to ALL</col>
 </row>

<row>
   <col name="MESSAGE_ID">STATISTICS_LEVEL_HIGH_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Automatic statistics collection allows the optimizer to generate accurate execution plans and is essential for identifying and correcting performance problems.  The STATISTICS_LEVEL initialization parameter is currently set to ALL, meaning additional timed OS and plan execution statistics are being collected.  These statistics are not necessary and create additional overhead on the system.</col>
 </row>

<row>
   <col name="MESSAGE_ID">STATISTICS_LEVEL_HIGH_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle recommends that you set the STATISTICS_LEVEL initialization parameter to TYPICAL.</col>
 </row>

<row>
   <col name="MESSAGE_ID">STATISTICS_LEVEL_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Disabled Automatic Statistics Collection</col>
 </row>

<row>
   <col name="MESSAGE_ID">STATISTICS_LEVEL_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks if the STATISTICS_LEVEL initialization parameter is set to BASIC</col>
 </row>

<row>
   <col name="MESSAGE_ID">STATISTICS_LEVEL_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Automatic statistics collection allows the optimizer to generate accurate execution plans and is essential for identifying and correcting performance problems.   By default, STATISTICS_LEVEL is set to TYPICAL.  If the STATISTICS_LEVEL initialization parameter is set to BASIC the collection of many important statistics, required by Oracle database features and functionality, are disabled.</col>
 </row>

<row>
   <col name="MESSAGE_ID">STATISTICS_LEVEL_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle strongly recommends that you set the STATISTICS_LEVEL initialization parameter to TYPICAL.</col>
 </row>

<row>
   <col name="MESSAGE_ID">TIMED_STATISTICS_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">TIMED_STATISTICS set to FALSE</col>
 </row>

<row>
   <col name="MESSAGE_ID">TIMED_STATISTICS_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks if the TIMED_STATISTICS initialization parameter is set to FALSE.</col>
 </row>

<row>
   <col name="MESSAGE_ID">TIMED_STATISTICS_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Setting TIMED_STATISTICS to FALSE prevents time related statistics, e.g. execution time for various internal operations, from being collected.  These statistics are useful for diagnosing and performance tuning.  Setting TIMED_STATISTICS to TRUE will allow time related statistics to be collected, and will also provide more value to the trace file and generates more accurate statistics for long-running operations.</col>
 </row>

<row>
   <col name="MESSAGE_ID">TIMED_STATISTICS_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle strongly recommends setting the TIMED_STATISTICS initialization parameter to TRUE.  TIMED_STATISTICS can be set either on a system level or on a session level.</col>
 </row>

<row>
   <col name="MESSAGE_ID">TIMED_STATISTICS_MESSAGE</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">TIMED_STATISTICS is set to FALSE.</col>
 </row>

<row>
   <col name="MESSAGE_ID">TIMED_STATISTICS_CLEAR_MESSAGE</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">TIMED_STATISTICS is set to TRUE.</col>
 </row>

<row>
   <col name="MESSAGE_ID">TIMED_STATISTICS_FIX</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Edit TIMED_STATISTICS Initialization Parameter</col>
 </row>

<row>
   <col name="MESSAGE_ID">AUTO_PGA_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Not Using Automatic PGA Management</col>
 </row>

<row>
   <col name="MESSAGE_ID">AUTO_PGA_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks if the PGA_AGGREGATE_TARGET initialization parameter has a value of 0 or if WORKAREA_SIZE_POLICY has value of MANUAL.</col>
 </row>

<row>
   <col name="MESSAGE_ID">AUTO_PGA_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Automatic PGA memory management simplifies and improves the way PGA memory is allocated. When enabled, Oracle can dynamically adjust the portion of the PGA memory dedicated to work areas while honoring the PGA_AGGREGATE_TARGET limit set by the DBA.</col>
 </row>

<row>
   <col name="MESSAGE_ID">AUTO_PGA_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle strongly recommends that you enable Automatic PGA Memory Management and set the PGA_AGGREGATE_TARGET initialization parameter to a non-zero number.  Use Oracle PGA advice to help set PGA_AGGREGATE_TARGET to the best size.</col>
 </row>

<row>
   <col name="MESSAGE_ID">SMALL_REDO_LOGS_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Insufficient Redo Log Size</col>
 </row>

<row>
   <col name="MESSAGE_ID">SMALL_REDO_LOGS_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks for redo log files less than 1 Mb</col>
 </row>

<row>
   <col name="MESSAGE_ID">SMALL_REDO_LOGS_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Small redo logs cause system checkpoints to continuously put a high load on the buffer cache and I/O system.</col>
 </row>

<row>
   <col name="MESSAGE_ID">SMALL_REDO_LOGS_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Increase size of the redo logs to at least 1 Mb.</col>
 </row>

<row>
   <col name="MESSAGE_ID">REDO_LOG_SIZE_TR_NLSID</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Redo Log File Size (MB)</col>
 </row>

<row>
   <col name="MESSAGE_ID">INSUFF_REDO_LOGS_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Insufficient Number of Redo Logs</col>
 </row>

<row>
   <col name="MESSAGE_ID">INSUFF_REDO_LOGS_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks for use of less than three redo logs</col>
 </row>

<row>
   <col name="MESSAGE_ID">INSUFF_REDO_LOGS_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The online redo log files are used to record changes in the database for  the purposes of recoverability. When archiving is enabled, these online redo logs need to be archived before they can be reused. Every database requires at least two online redo log groups to be up and running. When the size and number of online redo logs are inadequate, LGWR will wait for ARCH to complete its writing to the archived log destination, before it overwrites that log. This can cause severe performance slowdowns during peak activity periods.</col>
 </row>

<row>
   <col name="MESSAGE_ID">INSUFF_REDO_LOGS_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle recommends having at least three online redo log groups with at least two members in each group. For obvious reasons, members of the same group must be on different disk drives.</col>
 </row>

<row>
   <col name="MESSAGE_ID">REDO_LOG_COUNT_TR_NLSID</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Redo Log Count</col>
 </row>

<row>
   <col name="MESSAGE_ID">INSUFF_CONTROL_FILES_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Insufficient Number of Control Files</col>
 </row>

<row>
   <col name="MESSAGE_ID">INSUFF_CONTROL_FILES_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks for use of a single control file</col>
 </row>

<row>
   <col name="MESSAGE_ID">INSUFF_CONTROL_FILES_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The control file is one of the most important files in an Oracle database. It maintains many physical characteristics and important recovery information about the database. If you lose the only copy of the control file due to a media error, there will be unnecessary down time and other risks.</col>
 </row>

<row>
   <col name="MESSAGE_ID">INSUFF_CONTROL_FILES_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Use at least two control files that are multiplexed on different disks.</col>
 </row>

<row>
   <col name="MESSAGE_ID">CONTROL_FILE_COUNT_TR_NLSID</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Control File Count</col>
 </row>

<row>
   <col name="MESSAGE_ID">ASM_DISK_SIZE_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Disk Group Contains Disks of Significantly Different Sizes</col>
 </row>

<row>
   <col name="MESSAGE_ID">ASM_DISK_SIZE_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks the disk group for disks with disk sizes which vary by more than 5%.</col>
 </row>

<row>
   <col name="MESSAGE_ID">ASM_DISK_SIZE_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Disks in a disk group should have sizes within 5% of each other, unless data migration is in progress.  Automatic Storage Management distributes data uniformly proportional to the size of the disks.  For balanced I/O and optimal performance, disks in a given disk group should have similar size and performance characteristics.</col>
 </row>

<row>
   <col name="MESSAGE_ID">ASM_DISK_SIZE_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Remove, replace or resize disks in the disk group so the size difference between disks is less than 5%.</col>
 </row>

<row>
   <col name="MESSAGE_ID">ASM_DATA_PROTECTION_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Disk Group Depends on External Redundancy and has Unprotected Disks</col>
 </row>

<row>
   <col name="MESSAGE_ID">ASM_DATA_PROTECTION_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks the disk group, which depends on external redundancy, for disks that are not mirrored or parity protected.</col>
 </row>

<row>
   <col name="MESSAGE_ID">ASM_DATA_PROTECTION_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Data loss can occur if the disk group depends on external redundancy and disks are not mirrored or parity protected.</col>
 </row>

<row>
   <col name="MESSAGE_ID">ASM_DATA_PROTECTION_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Replace problem disks with mirrored or parity protected disks, or move unprotected disks into a disk group with NORMAL or HIGH redundancy.</col>
 </row>

<row>
   <col name="MESSAGE_ID">ASM_MIXED_REDUNDANCY_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Disk Group Contains Disks with Different Redundancy Attributes</col>
 </row>

<row>
   <col name="MESSAGE_ID">ASM_MIXED_REDUNDANCY_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks the disk group for disks that have different redundancy attributes.</col>
 </row>

<row>
   <col name="MESSAGE_ID">ASM_MIXED_REDUNDANCY_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Disks in the same disk group with different redundancy attributes may offer inconsistent levels of data protection.</col>
 </row>

<row>
   <col name="MESSAGE_ID">ASM_MIXED_REDUNDANCY_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Move disks with different redundancy attributes into separate disk groups.</col>
 </row>

<row>
   <col name="MESSAGE_ID">ASM_UNNEEDED_REDUNDANCY_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Disk Group with NORMAL or HIGH Redundancy has Mirrored or Parity Protected Disks</col>
 </row>

<row>
   <col name="MESSAGE_ID">ASM_UNNEEDED_REDUNDANCY_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks the disk group, with NORMAL or HIGH redundancy, for disks that are mirrored or parity protected.</col>
 </row>

<row>
   <col name="MESSAGE_ID">ASM_UNNEEDED_REDUNDANCY_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Disk resources are wasted, and performance may be unnecessarily affected when both a disk and its owning disk group are providing data redundancy.</col>
 </row>

<row>
   <col name="MESSAGE_ID">ASM_UNNEEDED_REDUNDANCY_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Replace disks in the NORMAL or HIGH redundancy disk group with unprotected disks.</col>
 </row>

<row>
   <col name="MESSAGE_ID">NO_RECOVERY_AREA_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Recovery Area Location Not Set</col>
 </row>

<row>
   <col name="MESSAGE_ID">NO_RECOVERY_AREA_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Checks for recovery area not set</col>
 </row>

<row>
   <col name="MESSAGE_ID">NO_RECOVERY_AREA_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Not setting the recovery area location will result in a divided storage location for all recovery components.</col>
 </row>

<row>
   <col name="MESSAGE_ID">NO_RECOVERY_AREA_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">It is recommended the recovery area location be set to provide a unified storage location for all recovery components.</col>
 </row>

<row>
   <col name="MESSAGE_ID">NO_FORCE_LOGGING_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Force Logging Disabled</col>
 </row>

<row>
   <col name="MESSAGE_ID">NO_FORCE_LOGGING_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">When Data Guard Broker is being used, checks the primary database for disabled force logging</col>
 </row>

<row>
   <col name="MESSAGE_ID">NO_FORCE_LOGGING_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The primary database is not in force logging mode.  As a result unlogged direct writes in the primary database cannot be propagated to the standby database.</col>
 </row>

<row>
   <col name="MESSAGE_ID">NO_FORCE_LOGGING_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The primary database should be put in force logging mode using ALTER DATABASE FORCE LOGGING.</col>
 </row>

<row>
   <col name="MESSAGE_ID">TKPROF_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">TKPROF Executable Permission</col>
 </row>

<row>
   <col name="MESSAGE_ID">TKPROF_NAME_NT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">TKPROF Executable Permission (Windows)</col>
 </row>

<row>
	 <col name="MESSAGE_ID">TKPROF_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures tkprof executable file permissions are restricted to read and execute for the group, and inaccessible to public</col>
 </row>

<row>
   <col name="MESSAGE_ID">TKPROF_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Excessive permission for tkprof leaves information within, unprotected.</col>
 </row>

<row>
   <col name="MESSAGE_ID">TKPROF_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Remove tkprof executable if not required. Otherwise, file permissions for tkprof executable should be restricted to read and execute for the group, and inaccessible to public.</col>
 </row>

<row>
   <col name="MESSAGE_ID">TKPROF_OWNER_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">TKPROF Executable Owner</col>
 </row>

<row>
	 <col name="MESSAGE_ID">TKPROF_OWNER_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures tkprof executable file is owned by Oracle software owner</col>
 </row>

<row>
   <col name="MESSAGE_ID">TKPROF_OWNER_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Not restricting ownership of tkprof to the Oracle software set and DBA group may cause information leak.</col>
 </row>

<row>
   <col name="MESSAGE_ID">TKPROF_OWNER_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Restrict permissions of the tkprof executable to the owner of the Oracle software set and the DBA group.</col>
 </row>
  

 <row>
   <col name="MESSAGE_ID">OTRACE_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Otrace Data Files</col>
 </row>

<row>
   <col name="MESSAGE_ID">OTRACE_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Avoids negative impact on database performance and disk space usage, caused by data collected by otrace</col>
 </row>

<row>
   <col name="MESSAGE_ID">OTRACE_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Performance and resource utilization data collection can have a negative impact on database performance and disk space usage.</col>
 </row>

<row>
   <col name="MESSAGE_ID">OTRACE_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Otrace should be disabled.</col>
 </row>

<row>
   <col name="MESSAGE_ID">SQLPLUS_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">SQL*Plus Executable Permission</col>
 </row>
 
 <row>
   <col name="MESSAGE_ID">SQLPLUS_NAME_NT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">SQL*Plus Executable Permission (Windows)</col>
 </row>

<row>
   <col name="MESSAGE_ID">SQLPLUS_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures that SQL*Plus executable file permissions are limited to the Oracle software set and DBA group</col>
 </row>

<row>
   <col name="MESSAGE_ID">SQLPLUS_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">SQL*Plus allows a user to execute any SQL on the database provided the user has an account with appropriate privileges. Public execute permissions on SQL*Plus can cause security issues by exposing sensitive data to malicious users.</col>
 </row>

<row>
   <col name="MESSAGE_ID">SQLPLUS_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Restrict file permissions for SQL*Plus executable to the Oracle software set and DBA group.</col>
 </row>

 <row>
   <col name="MESSAGE_ID">SQLPLUS_OWNER_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">SQL*Plus Executable Owner</col>
 </row>

<row>
   <col name="MESSAGE_ID">SQLPLUS_OWNER_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures SQL*Plus ownership is restricted to the Oracle software set and DBA group</col>
 </row>

<row>
   <col name="MESSAGE_ID">SQLPLUS_OWNER_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">SQL*Plus allows a user to execute any SQL on the database provided the user has an account with appropriate privileges. Not restricting ownership of SQL*Plus to the Oracle software set and DBA group may cause security issues by exposing sensitive data to malicious users.</col>
 </row>

<row>
   <col name="MESSAGE_ID">SQLPLUS_OWNER_RECOM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Restrict SQL*Plus ownership to the Oracle software set and DBA group.</col>
 </row>
 

 <row>
   <col name="MESSAGE_ID">WIN_PLATFORM_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Installation on Domain Controller</col>
 </row>

<row>
   <col name="MESSAGE_ID">WIN_PLATFORM_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures that Oracle is not installed on a domain controller</col>
 </row>

<row>
   <col name="MESSAGE_ID">WIN_PLATFORM_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Installing Oracle on a domain controller can cause serious security issues.</col>
 </row>

<row>
   <col name="MESSAGE_ID">WIN_PLATFORM_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle must only be installed on a domain member server or a standalone server.</col>
 </row>
 

 <row>
   <col name="MESSAGE_ID">DRIVE_PERM_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Installed Oracle Home Drive Permissions</col>
 </row>

<row>
   <col name="MESSAGE_ID">DRIVE_PERM_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">On Windows, ensures that the installed Oracle Home drive is not accessible to Everyone Group</col>
 </row>

<row>
   <col name="MESSAGE_ID">DRIVE_PERM_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Giving permission of Oracle installed drive to everyone can cause serious security issues.</col>
 </row>

<row>
   <col name="MESSAGE_ID">DRIVE_PERM_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The installed Oracle Home drive should not be accessible to Everyone Group.</col>
 </row>
 

 <row>
   <col name="MESSAGE_ID">DOMAIN_USERS_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Domain Users Group Member of Local Users Group</col>
 </row>

<row>
   <col name="MESSAGE_ID">DOMAIN_USERS_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures domain server local Users group does not have Domain Users group</col>
 </row>

<row>
   <col name="MESSAGE_ID">DOMAIN_USERS_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Including Domain Users group in local Users group of a domain server can cause serious security issues.</col>
 </row>

<row>
   <col name="MESSAGE_ID">DOMAIN_USERS_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Remove Domain Users group form local Users group.</col>
 </row>
 

 <row>
   <col name="MESSAGE_ID">WIN_TOOLS_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Windows Tools Permission</col>
 </row>

<row>
   <col name="MESSAGE_ID">WIN_TOOLS_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures Oracle service does not have permissions on windows tools</col>
 </row>

<row>
   <col name="MESSAGE_ID">WIN_TOOLS_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Granting Oracle service the permissions of windows tools may cause serious securty issues.</col>
 </row>

<row>
   <col name="MESSAGE_ID">WIN_TOOLS_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Remove permission to oracle service account of windows tools.</col>
 </row>
 

 <row>
   <col name="MESSAGE_ID">WEBCACHE_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Web Cache Initialization File Permission</col>
 </row>
 
 <row>
   <col name="MESSAGE_ID">WEBCACHE_NAME_NT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Web Cache Initialization File Permission (Windows)</col>
 </row>

<row>
   <col name="MESSAGE_ID">WEBCACHE_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures the Web Cache initialization file (webcache.xml) permissions are limited to the Oracle software set and DBA group</col>
 </row>

<row>
   <col name="MESSAGE_ID">WEBCACHE_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Web Cache stores sensitive information in the initialization file (webcache.xml). A publicly accessible Web Cache initialization file can be used to extract sensitive data like the administrator password hash.</col>
 </row>

<row>
   <col name="MESSAGE_ID">WEBCACHE_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Restrict Web Cache initialization file (webcache.xml) access to the Oracle software set and DBA group.</col>
 </row>
  

 <row>
   <col name="MESSAGE_ID">SNMP_RO_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle Agent SNMP Read-Only Configuration File Permission</col>
 </row>
 
 <row>
   <col name="MESSAGE_ID">SNMP_RO_NAME_NT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle Agent SNMP Read-Only Configuration File Permission (Windows)</col>
 </row>

<row>
   <col name="MESSAGE_ID">SNMP_RO_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures Oracle Agent SNMP read-only configuration file (snmp_ro.ora) permissions are limited to the Oracle software set and DBA group</col>
 </row>

<row>
   <col name="MESSAGE_ID">SNMP_RO_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The Oracle Agent SNMP read-only configuration file (snmp_ro.ora) contains the listening address of the agent, the names of SQL*Net listener and Oracle database services it knows about, plus tracing parameters. A publicly accessible SNMP read-only configuration file can be used to extract sensitive data like the tracing directory location, dbsnmp address, etc.</col>
 </row>

<row>
   <col name="MESSAGE_ID">SNMP_RO_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Restrict Oracle Agent SNMP read-only configuration file (snmp_ro.ora) access to the Oracle software set and DBA group.</col>
 </row>
 
 
 <row>
   <col name="MESSAGE_ID">SNMP_RW_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle Agent SNMP Read-Write Configuration File Permission</col>
 </row>
 
 <row>
   <col name="MESSAGE_ID">SNMP_RW_NAME_NT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle Agent SNMP Read-Write Configuration File Permission (Windows)</col>
 </row>

<row>
   <col name="MESSAGE_ID">SNMP_RW_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures Oracle Agent SNMP read-write configuration file (snmp_rw.ora) permissions are limited to the Oracle software set and DBA group</col>
 </row>

<row>
   <col name="MESSAGE_ID">SNMP_RW_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The Oracle Agent SNMP read-write configuration file (snmp_rw.ora) contains the listening address of the agent, the names of SQL*Net listener and Oracle database services it knows about, plus tracing parameters. A publicly accessible SNMP read-write configuration file can be used to extract sensitive data like the tracing directory location, dbsnmp address, etc.</col>
 </row>

<row>
   <col name="MESSAGE_ID">SNMP_RW_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Restrict Oracle Agent SNMP read-write configuration file (snmp_rw.ora) access to the Oracle software set and DBA group.</col>
 </row>

<row>
   <col name="MESSAGE_ID">WDBSVR_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle HTTP Server mod_plsql Configuration File Permission</col>
 </row>
 
 <row>
   <col name="MESSAGE_ID">WDBSVR_NAME_NT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle HTTP Server mod_plsql Configuration File Permission (Windows)</col>
 </row>

<row>
   <col name="MESSAGE_ID">WDBSVR_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures Oracle HTTP Server mod_plsql Configuration file (wdbsvr.app) permissions are limited to the Oracle software set and DBA group</col>
 </row>

<row>
   <col name="MESSAGE_ID">WDBSVR_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The Oracle HTTP Server mod_plsql configuration file (wdbsvr.app) contains the Database Access Descriptors used for authentication. A publicly accessible mod_plsql configuration file can allow a malicious user to modify the Database Access Descriptor settings to gain access to PL/SQL applications or launch a Denial Of Service attack.</col>
 </row>

<row>
   <col name="MESSAGE_ID">WDBSVR_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Restrict Oracle HTTP Server mod_plsql configuration file (wdbsvr.app) access to the Oracle software set and DBA group.</col>
 </row>

<row>
   <col name="MESSAGE_ID">XSQL_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle XSQL Configuration File Permission</col>
 </row>
 
 <row>
   <col name="MESSAGE_ID">XSQL_NAME_NT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle XSQL Configuration File Permission (Windows)</col>
 </row>

<row>
   <col name="MESSAGE_ID">XSQL_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures Oracle XSQL configuration file  (XSQLConfig.xml) permissions are limited to the Oracle software set and DBA group</col>
 </row>

<row>
   <col name="MESSAGE_ID">XSQL_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The Oracle XSQL configuration file (XSQLConfig.xml) contains sensitive database connection information. A publicly accessible XSQL configuration file can expose the database username and password that can be used access sensitive data or to launch further attacks.</col>
 </row>

<row>
   <col name="MESSAGE_ID">XSQL_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Restrict Oracle XSQL configuration file (XSQLConfig.xml) access to the Oracle software set and DBA group.</col>
 </row>
 

 <row>
   <col name="MESSAGE_ID">HTACCESS_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle HTTP Server Distributed Configuration Files Permission</col>
 </row>
 
 <row>
   <col name="MESSAGE_ID">HTACCESS_NAME_NT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle HTTP Server Distributed Configuration Files Permission (Windows)</col>
 </row>

<row>
   <col name="MESSAGE_ID">HTACCESS_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures Oracle HTTP Server Distributed Configuration Files permissions are limited to the Oracle software set and DBA group</col>
 </row>

<row>
   <col name="MESSAGE_ID">HTACCESS_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The Oracle HTTP Server distributed configuration file (usually .htaccess) is used for access control and authentication of web folders. This file can be modified to gain access to pages containing sensitive information.</col>
 </row>

<row>
   <col name="MESSAGE_ID">HTACCESS_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Restrict Oracle HTTP Server Distributed configuration files access to the Oracle software set and DBA group.</col>
 </row>
 
 
 <row>
   <col name="MESSAGE_ID">WEBCACHE_OWNER_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Web Cache Initialization File Owner</col>
 </row>

<row>
   <col name="MESSAGE_ID">WEBCACHE_OWNER_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures Web Cache initialization file (webcache.xml) is owned by Oracle software owner</col>
 </row>

<row>
   <col name="MESSAGE_ID">WEBCACHE_OWNER_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Web Cache stores sensitive information in the initialization file (webcache.xml). A publicly accessible Web Cache initialization file can be used to extract sensitive data like the administrator password hash.</col>
 </row>

<row>
   <col name="MESSAGE_ID">WEBCACHE_OWNER_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Restrict permission of Web Cache initialization file (webcache.xml) to the owner of Oracle software set and DBA group.</col>
 </row>
 

 <row>
   <col name="MESSAGE_ID">SNMP_RO_OWNER_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle Agent SNMP Read-Only Configuration File Owner</col>
 </row>

<row>
   <col name="MESSAGE_ID">SNMP_RO_OWNER_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures Oracle Agent SNMP read-only configuration file (snmp_ro.ora) is owned by Oracle software owner</col>
 </row>

<row>
   <col name="MESSAGE_ID">SNMP_RO_OWNER_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The Oracle Agent SNMP read-only configuration file (snmp_ro.ora) contains the listening address of the agent, the names of SQL*Net listener and Oracle database services it knows about, plus tracing parameters. A publicly accessible SNMP read-only configuration file can be used to extract sensitive data like the tracing directory location, dbsnmp address, etc.</col>
 </row>

<row>
   <col name="MESSAGE_ID">SNMP_RO_OWNER_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Restrict permissions of Oracle Agent SNMP read-only configuration file (snmp_ro.ora) to the owner of Oracle software set and DBA group.</col>
 </row>
 

 <row>
   <col name="MESSAGE_ID">SNMP_RW_OWNER_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle Agent SNMP Read-Write Configuration File  Owner</col>
 </row>

<row>
   <col name="MESSAGE_ID">SNMP_RW_OWNER_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures Oracle Agent SNMP read-write configuration file (snmp_rw.ora) is owned by Oracle software owner</col>
 </row>

<row>
   <col name="MESSAGE_ID">SNMP_RW_OWNER_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The Oracle Agent SNMP read-write configuration file (snmp_rw.ora) contains the listening address of the agent, the names of SQL*Net listener and Oracle database services it knows about, plus tracing parameters. A publicly accessible SNMP read-write configuration file can be used to extract sensitive data like the tracing directory location, dbsnmp address, etc.</col>
 </row>

<row>
   <col name="MESSAGE_ID">SNMP_RW_OWNER_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Restrict permissions of Oracle Agent SNMP read-write configuration file (snmp_rw.ora) to the owner of Oracle software set and DBA group</col>
 </row>
 

 <row>
   <col name="MESSAGE_ID">WDBSVR_OWNER_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle HTTP Server mod_plsql Configuration File Owner</col>
 </row>

<row>
   <col name="MESSAGE_ID">WDBSVR_OWNER_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures Oracle HTTP Server mod_plsql configuration file (wdbsvr.app) is owned by Oracle software owner</col>
 </row>

<row>
   <col name="MESSAGE_ID">WDBSVR_OWNER_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The Oracle HTTP Server mod_plsql configuration file (wdbsvr.app) contains the Database Access Descriptors used for authentication. A publicly accessible mod_plsql configuration file can allow a malicious user to modify the Database Access Descriptor settings to gain access to PL/SQL applications or launch a Denial Of Service attack.</col>
 </row>

<row>
   <col name="MESSAGE_ID">WDBSVR_OWNER_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Restrict permissions of Oracle HTTP Server mod_plsql configuration file (wdbsvr.app) to the owner of Oracle software set and DBA group.</col>
 </row>
 

 <row>
   <col name="MESSAGE_ID">XSQL_OWNER_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle XSQL Configuration File Owner</col>
 </row>

<row>
   <col name="MESSAGE_ID">XSQL_OWNER_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures Oracle XSQL configuration file (XSQLConfig.xml) is owned by Oracle software owner</col>
 </row>

<row>
   <col name="MESSAGE_ID">XSQL_OWNER_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The Oracle XSQL configuration file (XSQLConfig.xml) contains sensitive database connection information. A publicly accessible XSQL configuration file can expose the database username and password that can be used access sensitive data or to launch further attacks.</col>
 </row>

<row>
   <col name="MESSAGE_ID">XSQL_OWNER_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Restrict permissions of Oracle XSQL configuration file (XSQLConfig.xml) to the owner of Oracle software set and DBA group.</col>
 </row>

<row>
   <col name="MESSAGE_ID">HTACCESS_OWNER_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle HTTP Server Distributed Configuration File Owner</col>
 </row>

<row>
   <col name="MESSAGE_ID">HTACCESS_OWNER_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures Oracle HTTP Server distributed configuration file ownership is restricted to the Oracle software set and DBA group</col>
 </row>

<row>
   <col name="MESSAGE_ID">HTACCESS_OWNER_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The Oracle HTTP Server distributed configuration file (usually .htaccess) is used for access control and authentication of web folders. This file can be modified to gain access to pages containing sensitive information.</col>
 </row>

<row>
   <col name="MESSAGE_ID">HTACCESS_OWNER_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Restrict Oracle HTTP Server distributed configuration file ownership to the Oracle software set and DBA group.</col>
 </row>
 

 <row>
   <col name="MESSAGE_ID">ALL_PRIVILEGE_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Granting of ALL PRIVILEGES</col>
 </row>

<row>
   <col name="MESSAGE_ID">ALL_PRIVILEGE_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures ALL PRIVILEGES is never granted to any user or role</col>
 </row>

<row>
   <col name="MESSAGE_ID">ALL_PRIVILEGE_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">A privilege can be granted to any user or role. Excessive privileges can be misused. Never grant ALL PRIVILEGES to any user or role.</col>
 </row>

<row>
   <col name="MESSAGE_ID">ALL_PRIVILEGE_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">A privilege can be granted to any user or role. Excessive privileges can be misused. Never grant ALL PRIVILEGES to any user or role.</col>
 </row>
 

 <row>
   <col name="MESSAGE_ID">SELECT_ANY_TABLE_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Granting SELECT ANY TABLE Privilege</col>
 </row>

<row>
   <col name="MESSAGE_ID">SELECT_ANY_TABLE_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures SELECT ANY PRIVILEGE is never granted to any user or role</col>
 </row>

<row>
   <col name="MESSAGE_ID">SELECT_ANY_TABLE_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The SELECT ANY TABLE privilege can be used to grant users or roles with the ability to view data in tables that are not owned by them. A malicious user with access to any user account that has this privilege can use this to gain access to sensitive data.</col>
 </row>

<row>
   <col name="MESSAGE_ID">SELECT_ANY_TABLE_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Never grant SELECT ANY TABLE privilege.</col>
 </row>
 

 <row>
   <col name="MESSAGE_ID">SELECT_PRIVILEGE_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Access to DBA_* Views</col>
 </row>

<row>
   <col name="MESSAGE_ID">SELECT_PRIVILEGE_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures Select privilege is never granted to any DBA_ view</col>
 </row>

<row>
   <col name="MESSAGE_ID">SELECT_PRIVILEGE_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">The DBA_* views provide access to privileges and policy settings of the database. Some of these views also allow viewing of sensitive PL/SQL code that can be used to understand the security policies.</col>
 </row>

<row>
   <col name="MESSAGE_ID">SELECT_PRIVILEGE_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">None of the DBA_ views should be granted SELECT privileges. If there are users with the SELECT privilege, ensure all access to the DBA_ view is audited.</col>
 </row>
 
 
 <row>
   <col name="MESSAGE_ID">INSERT_FAILURE_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Audit Insert Failure</col>
 </row>

<row>
   <col name="MESSAGE_ID">INSERT_FAILURE_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures that insert failures are audited for critical data objects</col>
 </row>

<row>
   <col name="MESSAGE_ID">INSERT_FAILURE_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Not auditing insert failures for critical data objects may allow a malicious user to infiltrate system security.</col>
 </row>

<row>
   <col name="MESSAGE_ID">INSERT_FAILURE_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Audit insert failures for critical data objects.</col>
 </row>
 
 
 <row>
   <col name="MESSAGE_ID">EXECUTE_AND_OTHER_PRIVLEGES_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">EXECUTE and READ/WRITE privileges on Directory Objects</col>
 </row>

<row>
   <col name="MESSAGE_ID">EXECUTE_AND_OTHER_PRIVLEGES_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures that one user does not have EXECUTE and READ/WRITE privileges on the same directory object</col>
 </row>

<row>
   <col name="MESSAGE_ID">EXECUTE_AND_OTHER_PRIVLEGES_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">A knowledgeable malicious user can take advantage of directory object which is provided with EXECUTE along with READ/WRITE privilege.</col>
 </row>

<row>
   <col name="MESSAGE_ID">EXECUTE_AND_OTHER_PRIVLEGES_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle recommends that no user should be provided with EXECUTE along with READ/WRITE privilege on a particular directory object.</col>
 </row>
 
 
 <row>
   <col name="MESSAGE_ID">PUBLIC_EXECUTE_PRIV_DIROBJ_NAME</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">EXECUTE privileges on Directory Objects to PUBLIC</col>
 </row>

<row>
   <col name="MESSAGE_ID">PUBLIC_EXECUTE_PRIV_DIROBJ_DESC</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Ensures that PUBLIC does not have EXECUTE privilges on directory objects.</col>
 </row>

<row>
   <col name="MESSAGE_ID">PUBLIC_EXECUTE_PRIV_DIROBJ_IMPACT</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">A knowledgeable malicious user can take advantage of directory object which has granted EXECUTE privilege to PUBLIC.</col>
 </row>

<row>
   <col name="MESSAGE_ID">PUBLIC_EXECUTE_PRIV_DIROBJ_RECOMM</col>
   <col name="SUBSYSTEM">POLICY</col>
   <col name="MESSAGE">Oracle recommends that PUBLIC be not granted with EXECUTE privilege on directory objects.</col>
 </row>

</dataset>
</table>

Ms-Dos/Windows Unix Write backup

jsp File Browser version 1.2 by www.vonloesch.de