STIGQter: STIG Summary: MS SQL Server 2016 Instance Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

Database software, including DBMS configuration files, must be stored in dedicated directories, separate from the host OS and other applications.

DISA Rule

SV-213953r617437_rule

Vulnerability Number

V-213953

Group Title

SRG-APP-000133-DB-000199

Rule Version

SQL6-D0-006800

Severity

CAT II

CCI(s)

• CCI-001499 - The organization limits privileges to change software resident within software libraries.

Weight

10

Fix Recommendation

Re-install SQL Server application components using dedicated directories that are separate from the operating system.

Relocate or reinstall other application software that currently shares directories with SQL Server components.

Separate from the operating system and/or temporary storage.

Check Contents

Determine the directory in which SQL Server has been installed:

Using SQL Server Management Studio's Object Explorer:
- Right-click [SQL Server Instance]
- Select "Facets"
- Record the value of RootDirectory

Determine the Operating System directory:
- Click "Start"
- Type "Run"
- Press "Enter"
- Type "%windir%"
- Click "Ok"
- Record the value in the address bar

Verify the SQL Server RootDirectory is not in the Operating System directory.

Compare the SQL RootDirectory and the Operating System directory. If the SQL RootDirectory is in the same directory as the Operating System, this is a finding.

Verify the SQL Server RootDirectory is not in another application's directory.

Navigate to the SQL RootDirectory using Windows Explorer.

Examine each directory for evidence another application is stored in it.

If evidence exists the SQL RootDirectory is in another application's directory, this is a finding.

If the SQL RootDirectory is not in the Operating System directory or another application's directory. This is not a finding.

Examples:
1) The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is not living in the Operating System directory or the directory of another application. This is not a finding.

2) The Operating System directory is "C:\Windows". The SQL RootDirectory is "C:\Windows\MSSQLSERVER\MSSQL". This is a finding.

3) The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\Microsoft Office\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is in the Microsoft Office directory, which indicates Microsoft Office is installed here. This is a finding.

Vulnerability Number

V-213953

Documentable

False

Rule Version

SQL6-D0-006800

Severity Override Guidance

Determine the directory in which SQL Server has been installed:

Using SQL Server Management Studio's Object Explorer:
- Right-click [SQL Server Instance]
- Select "Facets"
- Record the value of RootDirectory

Determine the Operating System directory:
- Click "Start"
- Type "Run"
- Press "Enter"
- Type "%windir%"
- Click "Ok"
- Record the value in the address bar

Verify the SQL Server RootDirectory is not in the Operating System directory.

Compare the SQL RootDirectory and the Operating System directory. If the SQL RootDirectory is in the same directory as the Operating System, this is a finding.

Verify the SQL Server RootDirectory is not in another application's directory.

Navigate to the SQL RootDirectory using Windows Explorer.

Examine each directory for evidence another application is stored in it.

If evidence exists the SQL RootDirectory is in another application's directory, this is a finding.

If the SQL RootDirectory is not in the Operating System directory or another application's directory. This is not a finding.

Examples:
1) The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is not living in the Operating System directory or the directory of another application. This is not a finding.

2) The Operating System directory is "C:\Windows". The SQL RootDirectory is "C:\Windows\MSSQLSERVER\MSSQL". This is a finding.

3) The Operating System directory is "C:\Windows". The SQL RootDirectory is "D:\Program Files\Microsoft Office\MSSQLSERVER\MSSQL". The MSSQLSERVER directory is in the Microsoft Office directory, which indicates Microsoft Office is installed here. This is a finding.

Check Content Reference

M

Target Key

3993

Comments