STIGQter STIGQter: STIG Summary: MS SQL Server 2014 Database Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 26 Jan 2018:

SQL Server must implement and/or support cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.

DISA Rule

SV-81899r1_rule

Vulnerability Number

V-67409

Group Title

SRG-APP-000428-DB-000386

Rule Version

SQL4-00-034700

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Where full-disk encryption is required, configure Windows and/or the storage system to provide this.

Where transparent data encryption (TDE) is required, deploy the necessary stack of certificates and keys, and set the Encryption Enabled to True. For guidance from the Microsoft Developer Network on how to do this, perform a web search for "SQL Server 2014 TDE".

Where column encryption is required, deploy the necessary stack of certificates and keys, and enable encryption on the columns in question. For guidance from the Microsoft Developer Network on how to do this, perform a web search for "SQL Server 2014 Encrypt a Column of Data".

Check Contents

Review the system documentation to determine whether the organization has defined the information at rest that is to be protected from modification, which must include, at a minimum, PII and classified information.

If no information is identified as requiring such protection, this is not a finding.

Review the configuration of SQL Server, Windows, and additional software as relevant.

If full-disk encryption is required, and Windows or the storage system is not configured for this, this is a finding.

If database transparent data encryption (TDE) is called for, check whether it is enabled:
In SQL Server Management Studio, Object Explorer, expand the instance and right-click on the database name; select properties. Select the Options page, State section, Encryption Enabled parameter.

If the value displayed is False, this is a finding.

If column encryption, done via SQL Server features, is required, review the definitions and contents of the relevant tables and columns.

If any of the information defined as requiring cryptographic protection is not encrypted in a manner that provides the required level of protection, this is a finding.

Vulnerability Number

V-67409

Documentable

False

Rule Version

SQL4-00-034700

Severity Override Guidance

Review the system documentation to determine whether the organization has defined the information at rest that is to be protected from modification, which must include, at a minimum, PII and classified information.

If no information is identified as requiring such protection, this is not a finding.

Review the configuration of SQL Server, Windows, and additional software as relevant.

If full-disk encryption is required, and Windows or the storage system is not configured for this, this is a finding.

If database transparent data encryption (TDE) is called for, check whether it is enabled:
In SQL Server Management Studio, Object Explorer, expand the instance and right-click on the database name; select properties. Select the Options page, State section, Encryption Enabled parameter.

If the value displayed is False, this is a finding.

If column encryption, done via SQL Server features, is required, review the definitions and contents of the relevant tables and columns.

If any of the information defined as requiring cryptographic protection is not encrypted in a manner that provides the required level of protection, this is a finding.

Check Content Reference

M

Target Key

2637

Comments