2.9 Ensure 'Trustworthy' Database Property is set to 'Off'

Information

The TRUSTWORTHY database option allows database objects to access objects in other databases under certain circumstances.

Rationale:

Provides protection from malicious CLR assemblies or extended procedures.

Solution

Execute the following T-SQL statement against the databases (replace <database_name> below) returned by the Audit Procedure:

ALTER DATABASE [<database_name>] SET TRUSTWORTHY OFF;

Default Value:

By default, this database property is OFF (is_trustworthy_on = 0), except for the msdb database in which it is required to be ON.

See Also

https://workbench.cisecurity.org/benchmarks/7202

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: MS_SQLDB

Control ID: adf8a8e069b4556a017214d48f9724ced1ea5c0818ff0dc1bcbc876f05eb90b4