SQL4-00-002000 - SQL Server must enforce approved authorizations for logical access to information and database-level system resources in accordance with applicable access control policies.

CAT|II

CCI|CCI-000213

Rule-ID|SV-81847r1_rule

STIG-ID|SQL4-00-002000

Vuln-ID|V-67357

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - APPLICATION_ROLE_CHANGE_PASSWORD_GROUP

CCI|CCI-000169

Rule-ID|SV-81849r2_rule

STIG-ID|SQL4-00-011200

Vuln-ID|V-67359

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - AUDIT_CHANGE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - BACKUP_RESTORE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - DATABASE_CHANGE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - DATABASE_OBJECT_ACCESS_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - DATABASE_OBJECT_PERMISSION_CHANGE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - DATABASE_OPERATION_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - DATABASE_OWNERSHIP_CHANGE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - DATABASE_PERMISSION_CHANGE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - DATABASE_PRINCIPAL_CHANGE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - DATABASE_PRINCIPAL_IMPERSONATION_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - DATABASE_ROLE_MEMBER_CHANGE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - DBCC_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 14

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 15

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 16

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 17

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 18

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 20

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 42

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 43

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 46

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 47

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 90

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 102

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 103

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 104

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 105

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 106

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 107

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 108

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 109

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 110

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 111

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 112

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 113

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 115

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 116

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 117

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 118

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 128

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 129

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 130

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 131

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 132

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 133

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 134

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 135

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 152

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 153

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 162

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 164

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 170

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 171

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 172

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 173

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 175

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 176

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 177

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 178

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - Event ID 180

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - FAILED_LOGIN_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - LOGIN_CHANGE_PASSWORD_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - LOGOUT_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - SCHEMA_OBJECT_ACCESS_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - SCHEMA_OBJECT_CHANGE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - SERVER_OBJECT_CHANGE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - SERVER_OBJECT_PERMISSION_CHANGE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - SERVER_OPERATION_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - SERVER_PERMISSION_CHANGE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - SERVER_PRINCIPAL_CHANGE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - SERVER_PRINCIPAL_IMPERSONATION_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - SERVER_ROLE_MEMBER_CHANGE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - SERVER_STATE_CHANGE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - SUCCESSFUL_LOGIN_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events - TRACE_CHANGE_GROUP

SQL4-00-011200 - SQL Server must generate Trace or Audit records for organization-defined auditable events.

SQL4-00-011320 - Where SQL Server Audit is in use at the database level, SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited at the database level.

CCI|CCI-000171

Rule-ID|SV-81851r2_rule

STIG-ID|SQL4-00-011320

Vuln-ID|V-67361

SQL4-00-014900 - SQL Server must be monitored to discover unauthorized changes to functions.

CCI|CCI-001499

Rule-ID|SV-81855r2_rule

STIG-ID|SQL4-00-014900

Vuln-ID|V-67365

SQL4-00-015100 - SQL Server must be monitored to discover unauthorized changes to triggers.

Rule-ID|SV-81857r2_rule

STIG-ID|SQL4-00-015100

Vuln-ID|V-67367

SQL4-00-015200 - SQL Server must be monitored to discover unauthorized changes to stored procedures.

Rule-ID|SV-81859r2_rule

STIG-ID|SQL4-00-015200

Vuln-ID|V-67369

SQL4-00-015600 - Database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to SQL Server, etc.) must be owned by database/DBMS principals authorized for ownership.

Rule-ID|SV-81861r1_rule

STIG-ID|SQL4-00-015600

Vuln-ID|V-67371

SQL4-00-015610 - In a database owned by [sa], or by any other login having administrative privileges at the instance level, the database property TRUSTWORTHY must be OFF.

Rule-ID|SV-81865r1_rule

STIG-ID|SQL4-00-015610

Vuln-ID|V-67375

SQL4-00-015620 - In a database owned by a login not having administrative privileges at the instance level, the database property TRUSTWORTHY must be OFF unless required and authorized.

Rule-ID|SV-81863r1_rule

STIG-ID|SQL4-00-015620

Vuln-ID|V-67373

SQL4-00-021210 - In the event of a system failure, SQL Server must preserve any information necessary to return to operations with least disruption to mission processes.

CCI|CCI-001665

Rule-ID|SV-81867r2_rule

STIG-ID|SQL4-00-021210

Vuln-ID|V-67377

SQL4-00-021300 - SQL Server must protect data at rest and ensure confidentiality and integrity of data.

CCI|CCI-001199

Rule-ID|SV-82367r3_rule

STIG-ID|SQL4-00-021300

Vuln-ID|V-67877

SQL4-00-021800 - Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.

CCI|CCI-001090

Rule-ID|SV-81879r1_rule

STIG-ID|SQL4-00-021800

Vuln-ID|V-67389

SQL4-00-022500 - SQL Server must check the validity of all data inputs except those specifically identified by the organization.

CCI|CCI-001310

Rule-ID|SV-81881r2_rule

STIG-ID|SQL4-00-022500

Vuln-ID|V-67391

SQL4-00-022800 - The DBMS and associated applications must provide non-privileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

CCI|CCI-001312

Rule-ID|SV-81887r2_rule

STIG-ID|SQL4-00-022800

Vuln-ID|V-67397

SQL4-00-022900 - SQL Server must reveal detailed error messages only to the ISSO, ISSM (or their designees), SA and DBA.

CCI|CCI-001314

Rule-ID|SV-81889r2_rule

STIG-ID|SQL4-00-022900

Vuln-ID|V-67399

SQL4-00-024100 - The Database Master Key must be encrypted by the Service Master Key, where a Database Master Key is required and another encryption method has not been specified.

Rule-ID|SV-81871r1_rule

STIG-ID|SQL4-00-024100

Vuln-ID|V-67381

SQL4-00-024200 - Database Master Key passwords must not be stored in credentials within the database.

Rule-ID|SV-81873r1_rule

STIG-ID|SQL4-00-024200

Vuln-ID|V-67383

SQL4-00-024300 - Symmetric keys (other than the database master key) must use a DoD certificate to encrypt the key.

Rule-ID|SV-81875r2_rule

STIG-ID|SQL4-00-024300

Vuln-ID|V-67385

SQL4-00-031500 - The DBMS and associated applications must reserve the use of dynamic code execution for situations that require it.

Rule-ID|SV-81883r2_rule

STIG-ID|SQL4-00-031500

Vuln-ID|V-67393

SQL4-00-031600 - The DBMS and associated applications, when making use of dynamic code execution, must scan input data for invalid values that may indicate a code injection attack.

Detections

Analytics

DISA STIG SQL Server 2014 Database Audit v1r6

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Aug 21, 2024 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.1 Jun 17, 2024 Miscellaneous Metadata updated.

Detections

Analytics

DISA STIG SQL Server 2014 Database Audit v1r6 Download File

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

DISA STIG SQL Server 2014 Database Audit v1r6