2.10 Ensure 'Trustworthy' Database Property is set to 'Off'

Information

The TRUSTWORTHY database option allows database objects to access objects in other databases under certain circumstances.

Rationale:

Provides protection from malicious CLR assemblies or extended procedures.

Solution

Execute the following T-SQL statement against the databases (replace <database_name> below) returned by the Audit Procedure:

ALTER DATABASE [<database_name>] SET TRUSTWORTHY OFF;

Default Value:

By default, this database property is OFF (is_trustworthy_on = 0), except for the msdb database in which it is required to be ON.

References:

https://docs.microsoft.com/en-us/sql/relational-databases/security/trustworthy-database-property

https://support.microsoft.com/it-it/help/2183687/guidelines-for-using-the-trustworthy-database-setting-in-sql-server

See Also

https://workbench.cisecurity.org/files/2834

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3, CSCv6|3.1, CSCv7|14.6

Plugin: MS_SQLDB

Control ID: e307136d2d7732c5ea82549d60b86fb2f0a2eb30612de401b47fe1d43b778b35