STIGQter: STIG Summary: MS SQL Server 2014 Instance Security Technical Implementation Guide Version: 1 Release: 10 Benchmark Date: 24 Apr 2020:

The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to SQL Server, etc.) must be restricted to authorized users.

DISA Rule

SV-82305r1_rule

Vulnerability Number

V-67815

Group Title

SRG-APP-000133-DB-000362

Rule Version

SQL4-00-030700

Severity

CAT II

CCI(s)

• CCI-001499 - The organization limits privileges to change software resident within software libraries.

Weight

10

Fix Recommendation

Revoke unauthorized memberships in the group(s)/role(s) designated for DBMS and database modification.

Syntax examples:

ALTER ROLE Power DROP MEMBER JenUser; -- the member is a database role or database user.
ALTER SERVER ROLE GreatPower DROP MEMBER Irresponsibility; -- the member is a server role or login.

Check Contents

Using the system security plan, identify the group(s)/role(s) established for SQL Server DBMS and database modification, and the individuals authorized to modify the DBMS and database(s). If helpful, the views STIG.server_permissions and STIG.database_permissions, provided in the supplemental file Permissions.sql, can be used to search for the relevant roles: look for Permission values containing "Alter," "Create," "Control," etc.

Obtain the list of users in those group(s)/roles. The provided functions STIG.members_of_db_role() and STIG.members_of_server_role(), can be used for this.

If unauthorized access to the group(s)/role(s) has been granted, this is a finding.

Vulnerability Number

V-67815

Documentable

False

Rule Version

SQL4-00-030700

Severity Override Guidance

Using the system security plan, identify the group(s)/role(s) established for SQL Server DBMS and database modification, and the individuals authorized to modify the DBMS and database(s). If helpful, the views STIG.server_permissions and STIG.database_permissions, provided in the supplemental file Permissions.sql, can be used to search for the relevant roles: look for Permission values containing "Alter," "Create," "Control," etc.

Obtain the list of users in those group(s)/roles. The provided functions STIG.members_of_db_role() and STIG.members_of_server_role(), can be used for this.

If unauthorized access to the group(s)/role(s) has been granted, this is a finding.

Check Content Reference

M

Target Key

2639

Comments