SQL4-00-023700 - SQL Server must protect against an individual using a shared account from falsely denying having performed a particular action.

Information

Non-repudiation of actions taken is required in order to maintain application integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message.

Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database.

Use of shared accounts does not provide individual accountability for actions taken on the DBMS or data. Whenever a single database account is used to connect to the database, a secondary authentication method that provides individual accountability is required. This scenario most frequently occurs when an externally hosted application authenticates individual users to the application and the application uses a single account to retrieve or update database information on behalf of the individual users (as in connection pooling).

When shared accounts are utilized without another means of identifying individual users, users may deny having performed a particular action.

(Shared accounts should not be confused with Windows groups, which are used in role-based access control.)

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Remove user-accessible shared accounts and use individual userids.

Build/configure applications to ensure successful individual authentication prior to shared account access.

Ensure each user's identity is received and used in audit data in all relevant circumstances.

Design, develop, and implement a method to log use of any account to which more than one person has access. Restrict interactive access to shared accounts to the fewest persons possible.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_SQL_Server_2014_Y24M07_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-10, CAT|II, CCI|CCI-000166, Rule-ID|SV-213856r960864_rule, STIG-ID|SQL4-00-023700, STIG-Legacy|SV-82253, STIG-Legacy|V-67763, Vuln-ID|V-213856

Plugin: MS_SQLDB

Control ID: a959205931552e55e2d90c47e5c956995ea7a354320e63c56c06815708efbfe2