STIGQter: STIG Summary: MS SQL Server 2014 Instance Security Technical Implementation Guide Version: 1 Release: 10 Benchmark Date: 24 Apr 2020:

Audit tools used in, or in conjunction with, SQL Server must be protected from unauthorized access.

DISA Rule

SV-82285r2_rule

Vulnerability Number

V-67795

Group Title

SRG-APP-000121-DB-000202

Rule Version

SQL4-00-013900

Severity

CAT II

CCI(s)

• CCI-001493 - The information system protects audit tools from unauthorized access.

Weight

10

Fix Recommendation

Remove audit-related permissions from individuals and roles not authorized to have them.

Check Contents

Check the server documentation for a list of approved users with access to SQL Server Audits.

To create, alter, or drop a server audit, principals require the "ALTER ANY SERVER AUDIT" or the "CONTROL SERVER" permission. To view an Audit log requires the "CONTROL SERVER" permission. To use Profiler, "ALTER TRACE" is required.

Review the SQL Server permissions granted to principals. Look for permissions "ALTER ANY SERVER AUDIT", "ALTER ANY DATABASE AUDIT", "CONTROL SERVER", and "ALTER TRACE":

SELECT login.name, perm.permission_name, perm.state_desc
FROM sys.server_permissions perm -- or STIG.server_permissions
JOIN sys.server_principals login
ON perm.grantee_principal_id = login.principal_id
WHERE permission_name in ('CONTROL SERVER', 'ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT','ALTER TRACE')
and login.name not like '##MS_%';

If unauthorized accounts have these privileges, this is a finding.

Vulnerability Number

V-67795

Documentable

False

Rule Version

SQL4-00-013900

Severity Override Guidance

Check the server documentation for a list of approved users with access to SQL Server Audits.

To create, alter, or drop a server audit, principals require the "ALTER ANY SERVER AUDIT" or the "CONTROL SERVER" permission. To view an Audit log requires the "CONTROL SERVER" permission. To use Profiler, "ALTER TRACE" is required.

Review the SQL Server permissions granted to principals. Look for permissions "ALTER ANY SERVER AUDIT", "ALTER ANY DATABASE AUDIT", "CONTROL SERVER", and "ALTER TRACE":

SELECT login.name, perm.permission_name, perm.state_desc
FROM sys.server_permissions perm -- or STIG.server_permissions
JOIN sys.server_principals login
ON perm.grantee_principal_id = login.principal_id
WHERE permission_name in ('CONTROL SERVER', 'ALTER ANY DATABASE AUDIT', 'ALTER ANY SERVER AUDIT','ALTER TRACE')
and login.name not like '##MS_%';

If unauthorized accounts have these privileges, this is a finding.

Check Content Reference

M

Target Key

2639

Comments