Ensure that the database engine runs a supported version and receives security patches automatically, so that published engine vulnerabilities cannot be exploited against the instance.
Apply Database Engine Security Patches
CCC.RDMS.CN06 · Compute
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.RDMS.CP18 | Automated Engine Patching | The service may be configured to apply database engine security patches and minor version upgrades during a maintenance window, to limit exposure to known engine vulnerabilities; on some providers this is always on. |
| CCC.RDMS.CP02 | DB Engine Option - MySQL | The service can provision a managed relational database running the MySQL engine. |
| CCC.RDMS.CP03 | DB Engine Option - PostgreSQL | The service can provision a managed relational database running the PostgreSQL engine. |
| CCC.RDMS.CP05 | DB Engine Option - SQL Server | The service can provision a managed relational database running the Microsoft SQL Server engine. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.RDMS.TH06 | Database Engine Runs with Known Vulnerabilities | Automated engine patching may be disabled, or maintenance windows may be deferred indefinitely, so the database engine continues to run a version with published vulnerabilities. Those vulnerabilities can be exploited by any client able to reach the engine, compromising the confidentiality, integrity, and availability of the database. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.RDMS.CN06.AR01 | When the service offers automatic minor version upgrades, the database instance MUST have automatic minor version upgrades enabled. | tlp-amber, tlp-red |
| CCC.RDMS.CN06.AR02 | When the database instance is running, its engine version MUST be one for which the provider still publishes security patches. | tlp-clear, tlp-green, tlp-amber, tlp-red |