STIGQter: STIG Summary: MS SQL Server 2016 Instance Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

SQL Server must by default shut down upon audit failure, to include the unavailability of space for more audit log records; or must be configurable to shut down upon audit failure.

DISA Rule

SV-213942r617437_rule

Vulnerability Number

V-213942

Group Title

SRG-APP-000109-DB-000049

Rule Version

SQL6-D0-005600

Severity

CAT II

CCI(s)

• CCI-000140 - The information system takes organization-defined actions upon audit failure (e.g., shut down information system, overwrite oldest audit records, stop generating audit records).

Weight

10

Fix Recommendation

If SQL Server Audit is in use, configure SQL Server Audit to shut SQL Server down upon audit failure, to include running out of space for audit logs.

Run this T-SQL script for each identified audit:

ALTER SERVER AUDIT [AuditNameHere] WITH (STATE = OFF);
GO
ALTER SERVER AUDIT [AuditNameHere] WITH (ON_FAILURE = SHUTDOWN);
GO
ALTER SERVER AUDIT [AuditNameHere] WITH (STATE = ON);
GO

Check Contents

If the system documentation indicates that availability takes precedence over audit trail completeness, this is not applicable (NA).

If SQL Server Audit is in use, review the defined server audits by running the statement:

SELECT * FROM sys.server_audits;

By observing the [name] and [is_state_enabled] columns, identify the row or rows in use.

If the [on_failure_desc] is "SHUTDOWN SERVER INSTANCE" on this/these row(s), this is not a finding. Otherwise, this is a finding.

Vulnerability Number

V-213942

Documentable

False

Rule Version

SQL6-D0-005600

Severity Override Guidance

If the system documentation indicates that availability takes precedence over audit trail completeness, this is not applicable (NA).

If SQL Server Audit is in use, review the defined server audits by running the statement:

SELECT * FROM sys.server_audits;

By observing the [name] and [is_state_enabled] columns, identify the row or rows in use.

If the [on_failure_desc] is "SHUTDOWN SERVER INSTANCE" on this/these row(s), this is not a finding. Otherwise, this is a finding.

Check Content Reference

M

Target Key

3993

Comments