STIGQter: STIG Summary: MS SQL Server 2014 Database Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 26 Jan 2018:

SQL Server must be monitored to discover unauthorized changes to triggers.

DISA Rule

SV-81857r2_rule

Vulnerability Number

V-67367

Group Title

SRG-APP-000133-DB-000179

Rule Version

SQL4-00-015100

Severity

CAT II

CCI(s)

• CCI-001499 - The organization limits privileges to change software resident within software libraries.

Weight

10

Fix Recommendation

Configure a SQL Server timed job that automatically checks all system and user-defined Triggers for modification.

(The supplemental file Track.sql, provided with this STIG, can be used to establish a monitoring job. This should be supplemented with a process for informing the appropriate personnel. Other techniques for achieving the same ends, such as the use of DDL triggers, are acceptable.)

Check Contents

Check the SQL Server configuration for the timed job that automatically checks all system and user-defined Triggers for being modified by running the following SQL Server query:
EXEC msdb.dbo.sp_help_job @job_name = '<enter . . . job name>';

(Alternatively, in SQL Server Management Studio, navigate to SQL Server Agent and examine the job from there.)

If such a job, or an alternative method of monitoring triggers for modification, does not exist, this is a finding

Vulnerability Number

V-67367

Documentable

False

Rule Version

SQL4-00-015100

Severity Override Guidance

Check the SQL Server configuration for the timed job that automatically checks all system and user-defined Triggers for being modified by running the following SQL Server query:
EXEC msdb.dbo.sp_help_job @job_name = '<enter . . . job name>';

(Alternatively, in SQL Server Management Studio, navigate to SQL Server Agent and examine the job from there.)

If such a job, or an alternative method of monitoring triggers for modification, does not exist, this is a finding

Check Content Reference

M

Target Key

2637

Comments