STIGQter STIGQter: STIG Summary: MS SQL Server 2016 Instance Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

SQL Server must uniquely identify and authenticate non-organizational users (or processes acting on behalf of non-organizational users).

DISA Rule

SV-213970r617437_rule

Vulnerability Number

V-213970

Group Title

SRG-APP-000180-DB-000115

Rule Version

SQL6-D0-008800

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Ensure all logins are uniquely identifiable and authenticate all non-organizational users who log onto the system. This likely would be done via a combination of the operating system with unique accounts and the SQL Server by ensuring mapping to individual accounts. Verify server documentation to ensure accounts are documented and unique.

Check Contents

Review documentation, SQL Server settings, and authentication system settings to determine if non-organizational users are individually identified and authenticated when logging onto the system.

Execute the following query to obtain a list of logins on the SQL Server and ensure all accounts are uniquely identifiable:

SELECT name, type_desc FROM sys.server_principals WHERE type in ('S','U')

If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to SQL Server using a standard, shared account, ensure that it also captures the individual user identification and passes it to SQL Server.

If the documentation indicates that this is a public-facing, read-only (from the point of view of public users) database that does not require individual authentication, this is not a finding.

If non-organizational users are not uniquely identified and authenticated, this is a finding.

Vulnerability Number

V-213970

Documentable

False

Rule Version

SQL6-D0-008800

Severity Override Guidance

Review documentation, SQL Server settings, and authentication system settings to determine if non-organizational users are individually identified and authenticated when logging onto the system.

Execute the following query to obtain a list of logins on the SQL Server and ensure all accounts are uniquely identifiable:

SELECT name, type_desc FROM sys.server_principals WHERE type in ('S','U')

If accounts are determined to be shared, determine if individuals are first individually authenticated. Where an application connects to SQL Server using a standard, shared account, ensure that it also captures the individual user identification and passes it to SQL Server.

If the documentation indicates that this is a public-facing, read-only (from the point of view of public users) database that does not require individual authentication, this is not a finding.

If non-organizational users are not uniquely identified and authenticated, this is a finding.

Check Content Reference

M

Target Key

3993

Comments