2.9 Ensure 'Trustworthy' Database Property is set to 'Off'

Information

The TRUSTWORTHY database option allows database objects to access objects in other databases under certain circumstances.

Rationale:

Provides protection from malicious CLR assemblies or extended procedures.

Solution

Execute the following T-SQL statement against the databases (replace <database_name> below) returned by the Audit Procedure:

ALTER DATABASE [<database_name>] SET TRUSTWORTHY OFF;

Default Value:

By default, this database property is OFF (is_trustworthy_on = 0), except for the msdb database in which it is required to be ON.

See Also

https://workbench.cisecurity.org/files/2945

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3, CSCv6|14.4, CSCv7|14.6

Plugin: MS_SQLDB

Control ID: 525627f96713a3b7eb30be21610a98907c63a819ab4e89966cfcd3400e912eeb