SQL2-00-015350 - Software, applications, and configuration files that are part of, or related to, the SQL Server 2012 installation must be monitored to discover unauthorized changes.

Information

When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of applications and tools related to SQL Server can potentially have significant effects on the overall security of the system. Only qualified and authorized individuals shall be allowed to obtain access to components related to SQL Server for purposes of initiating changes, including upgrades and modifications.

Unmanaged changes that occur to the software libraries or configuration can lead to unauthorized or compromised installations.

Of particular note in this context is that any software installed for auditing and/or audit file management must be protected and monitored.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Include locations of all files, libraries, scripts, and executables that are part of, or related to, the SQL Server 2012 installation in the documentation.

Deploy a security and data integrity tool for monitoring and alerting files and folders based on cryptographic hashes, to verify files/folder locations as listed in the documentation.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_SQL_Server_2012_V1R20_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AU-9, 800-53|SI-7(6), CAT|I, CCI|CCI-001493, CCI|CCI-001494, CCI|CCI-001495, CCI|CCI-002716, CCI|CCI-002718, Rule-ID|SV-53302r5_rule, STIG-ID|SQL2-00-015350, Vuln-ID|V-40948

Plugin: Windows

Control ID: 3a614456aa6f6984381ac3a5767158b9e7cd126e3783d2abf4a51a65812f4601