SQL6-D0-000100 - SQL Server databases must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals - Authentication Mode

CAT|I

CCI|CCI-000015

Rule-ID|SV-213900r822444_rule

STIG-ID|SQL6-D0-000100

STIG-Legacy|SV-93767

STIG-Legacy|V-79061

Vuln-ID|V-213900

SQL6-D0-000100 - SQL Server databases must integrate with an organization-level authentication/access mechanism providing account management and automation for all users, groups, roles, and any other principals - contained database authentication

SQL6-D0-000300 - SQL Server must enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

CCI|CCI-000213

Rule-ID|SV-213901r822446_rule

STIG-ID|SQL6-D0-000300

STIG-Legacy|SV-93771

STIG-Legacy|V-79065

Vuln-ID|V-213901

SQL6-D0-000400 - SQL Server must protect against a user falsely repudiating by ensuring only clearly unique Active Directory user accounts can connect to the database.

CCI|CCI-000166

Rule-ID|SV-213902r508025_rule

STIG-ID|SQL6-D0-000400

STIG-Legacy|SV-93773

STIG-Legacy|V-79067

Vuln-ID|V-213902

SQL6-D0-000500 - SQL Server must protect against a user falsely repudiating by use of system-versioned tables (Temporal Tables).

CAT|III

Rule-ID|SV-213903r508025_rule

STIG-ID|SQL6-D0-000500

STIG-Legacy|SV-93775

STIG-Legacy|V-79069

Vuln-ID|V-213903

SQL6-D0-000600 - SQL Server must protect against a user falsely repudiating by ensuring databases are not in a trust relationship.

Rule-ID|SV-213904r508025_rule

STIG-ID|SQL6-D0-000600

STIG-Legacy|SV-93777

STIG-Legacy|V-79071

Vuln-ID|V-213904

SQL6-D0-000700 - SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - permissions

CAT|II

CCI|CCI-000171

Rule-ID|SV-213905r508025_rule

STIG-ID|SQL6-D0-000700

STIG-Legacy|SV-93779

STIG-Legacy|V-79073

Vuln-ID|V-213905

SQL6-D0-000700 - SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - roles

SQL6-D0-001100 - SQL Server must limit privileges to change software modules, to include stored procedures, functions, and triggers.

CCI|CCI-001499

Rule-ID|SV-213906r810829_rule

STIG-ID|SQL6-D0-001100

STIG-Legacy|SV-93781

STIG-Legacy|V-79075

Vuln-ID|V-213906

SQL6-D0-001200 - SQL Server must limit privileges to change software modules, to include stored procedures, functions, and triggers, and links to software external to SQL Server.

Rule-ID|SV-213907r508025_rule

STIG-ID|SQL6-D0-001200

STIG-Legacy|SV-93783

STIG-Legacy|V-79077

Vuln-ID|V-213907

SQL6-D0-001300 - Database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to SQL Server, etc.) must be owned by database/DBMS principals authorized for ownership.

Rule-ID|SV-213908r508025_rule

STIG-ID|SQL6-D0-001300

STIG-Legacy|SV-93785

STIG-Legacy|V-79079

Vuln-ID|V-213908

SQL6-D0-001400 - The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to SQL Server, etc.) must be restricted to authorized users.

Rule-ID|SV-213909r508025_rule

STIG-ID|SQL6-D0-001400

STIG-Legacy|SV-93787

STIG-Legacy|V-79081

Vuln-ID|V-213909

SQL6-D0-001500 - In the event of a system failure, hardware loss or disk failure, SQL Server must be able to restore necessary databases with least disruption to mission processes - history

CCI|CCI-001665

Rule-ID|SV-213910r508025_rule

STIG-ID|SQL6-D0-001500

STIG-Legacy|SV-93789

STIG-Legacy|V-79083

Vuln-ID|V-213910

SQL6-D0-001500 - In the event of a system failure, hardware loss or disk failure, SQL Server must be able to restore necessary databases with least disruption to mission processes - model

SQL6-D0-001600 - The Database Master Key encryption password must meet DOD password complexity requirements.

CCI|CCI-001199

Rule-ID|SV-213911r508025_rule

STIG-ID|SQL6-D0-001600

STIG-Legacy|SV-93791

STIG-Legacy|V-79085

Vuln-ID|V-213911

SQL6-D0-001700 - The Database Master Key must be encrypted by the Service Master Key, where a Database Master Key is required and another encryption method has not been specified.

Rule-ID|SV-213912r508025_rule

STIG-ID|SQL6-D0-001700

STIG-Legacy|SV-93793

STIG-Legacy|V-79087

Vuln-ID|V-213912

SQL6-D0-001800 - The Certificate used for encryption must be backed up, stored offline and off-site.

Rule-ID|SV-213913r508025_rule

STIG-ID|SQL6-D0-001800

STIG-Legacy|SV-93795

STIG-Legacy|V-79089

Vuln-ID|V-213913

SQL6-D0-001900 - SQL Server must isolate security functions from non-security functions.

CCI|CCI-001084

Rule-ID|SV-213914r822449_rule

STIG-ID|SQL6-D0-001900

STIG-Legacy|SV-93797

STIG-Legacy|V-79091

Vuln-ID|V-213914

SQL6-D0-002000 - Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.

CCI|CCI-001090

Rule-ID|SV-213915r508025_rule

STIG-ID|SQL6-D0-002000

STIG-Legacy|SV-93799

STIG-Legacy|V-79093

Vuln-ID|V-213915

SQL6-D0-002100 - SQL Server must check the validity of all data inputs except those specifically identified by the organization.

CCI|CCI-001310

Rule-ID|SV-213916r508025_rule

STIG-ID|SQL6-D0-002100

STIG-Legacy|SV-93801

STIG-Legacy|V-79095

Vuln-ID|V-213916

SQL6-D0-002400 - SQL Server must provide non-privileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

CCI|CCI-001312

Rule-ID|SV-213917r508025_rule

STIG-ID|SQL6-D0-002400

STIG-Legacy|SV-93803

STIG-Legacy|V-79097

Vuln-ID|V-213917

SQL6-D0-002500 - SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in storage.

CCI|CCI-002262

Rule-ID|SV-213918r855953_rule

STIG-ID|SQL6-D0-002500

STIG-Legacy|SV-93805

STIG-Legacy|V-79099

Vuln-ID|V-213918

SQL6-D0-002600 - SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in process.

CCI|CCI-002263

Rule-ID|SV-213919r855954_rule

STIG-ID|SQL6-D0-002600

STIG-Legacy|SV-93807

STIG-Legacy|V-79101

Vuln-ID|V-213919

SQL6-D0-002700 - SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in transmission.

CCI|CCI-002264

Rule-ID|SV-213920r855955_rule

STIG-ID|SQL6-D0-002700

STIG-Legacy|SV-93809

STIG-Legacy|V-79103

Vuln-ID|V-213920

SQL6-D0-002800 - SQL Server must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects - object ownership

CCI|CCI-002165

Rule-ID|SV-213921r855956_rule

STIG-ID|SQL6-D0-002800

STIG-Legacy|SV-93811

STIG-Legacy|V-79105

Vuln-ID|V-213921

SQL6-D0-002800 - SQL Server must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects - permission rights

SQL6-D0-002800 - SQL Server must enforce discretionary access control policies, as defined by the data owner, over defined subjects and objects - schema ownership

SQL6-D0-002900 - Execution of stored procedures and functions that utilize execute as must be restricted to necessary cases only.

CCI|CCI-002233

Rule-ID|SV-213922r855957_rule

STIG-ID|SQL6-D0-002900

STIG-Legacy|SV-93813

STIG-Legacy|V-79107

Vuln-ID|V-213922

SQL6-D0-003000 - SQL Server must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status - role membership

CCI|CCI-001812

Rule-ID|SV-213923r855958_rule

STIG-ID|SQL6-D0-003000

STIG-Legacy|SV-93815

STIG-Legacy|V-79109

Vuln-ID|V-213923

SQL6-D0-003000 - SQL Server must prohibit user installation of logic modules (stored procedures, functions, triggers, views, etc.) without explicit privileged status - role permissions

SQL6-D0-003100 - SQL Server must enforce access restrictions associated with changes to the configuration of the database(s).

CCI|CCI-001813

Rule-ID|SV-213924r855959_rule

STIG-ID|SQL6-D0-003100

STIG-Legacy|SV-93817

STIG-Legacy|V-79111

Vuln-ID|V-213924

SQL6-D0-003200 - SQL Server must use NSA-approved cryptography to protect classified information in accordance with the data owners requirements - DB

CCI|CCI-002450

Rule-ID|SV-251040r863346_rule

STIG-ID|SQL6-D0-003200

STIG-Legacy|SV-93819

STIG-Legacy|V-79113

Vuln-ID|V-251040

SQL6-D0-003200 - SQL Server must use NSA-approved cryptography to protect classified information in accordance with the data owners requirements - OS

SQL6-D0-003300 - SQL Server must implement cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.

CCI|CCI-002475

Rule-ID|SV-213926r855960_rule

STIG-ID|SQL6-D0-003300

STIG-Legacy|SV-93821

STIG-Legacy|V-79115

Vuln-ID|V-213926

SQL6-D0-003400 - SQL Server must implement cryptographic mechanisms preventing the unauthorized disclosure of organization-defined information at rest on organization-defined information system components.

Detections

Analytics

DISA STIG SQL Server 2016 Database Audit v2r5

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous