STIGQter STIGQter: STIG Summary: MS SQL Server 2014 Instance Security Technical Implementation Guide Version: 1 Release: 10 Benchmark Date: 24 Apr 2020:

SQL Server must be configured to separate user functionality (including user interface services) from database management functionality.

DISA Rule

SV-82365r1_rule

Vulnerability Number

V-67875

Group Title

SRG-APP-000211-DB-000122

Rule Version

SQL4-00-020500

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Establish one or more locally-defined server roles and one or more locally-defined database roles for organizing administrative permissions. Grant administrative permissions to these roles. Assign the appropriate administrative users to these roles. Do not grant the roles and permissions to general users.

Check Contents

Check SQL Server permission settings to verify that administrative functionality is kept separate from user functionality. The views and functions provided in the supplemental file Permissions.sql can help with this review.

If administrator and general user functionality are not separated either physically or logically, this is a finding.

Vulnerability Number

V-67875

Documentable

False

Rule Version

SQL4-00-020500

Severity Override Guidance

Check SQL Server permission settings to verify that administrative functionality is kept separate from user functionality. The views and functions provided in the supplemental file Permissions.sql can help with this review.

If administrator and general user functionality are not separated either physically or logically, this is a finding.

Check Content Reference

M

Target Key

2639

Comments