STIGQter: STIG Summary: MS SQL Server 2014 Instance Security Technical Implementation Guide Version: 1 Release: 10 Benchmark Date: 24 Apr 2020:

SQL Server must use NIST FIPS 140-2 validated cryptographic modules for cryptographic operations.

DISA Rule

SV-82361r1_rule

Vulnerability Number

V-67871

Group Title

SRG-APP-000179-DB-000114

Rule Version

SQL4-00-031100

Severity

CAT I

CCI(s)

• CCI-000803 - The information system implements mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
• CCI-002450 - The information system implements organization-defined cryptographic uses and type of cryptography required for each use in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.

Weight

10

Fix Recommendation

In Windows, open Administrative Tools >> Local Security Policy. Expand Local Policies >> Security Options. In the right-side pane, double-click on "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing".

In the dialog box that appears, if the radio buttons are active, click Enabled, and then click Apply. If the radio buttons are grayed out, use Group Policy Management (on the appropriate server for this domain) to enforce the Enabled policy, and deploy it to the server(s) running SQL Server.

Check Contents

In Windows, open Administrative Tools >> Local Security Policy. Expand Local Policies >> Security Options. In the right-side pane, find "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing".

If, in the Security Setting column, the value is "Disabled," this is a finding.

Vulnerability Number

V-67871

Documentable

False

Rule Version

SQL4-00-031100

Severity Override Guidance

In Windows, open Administrative Tools >> Local Security Policy. Expand Local Policies >> Security Options. In the right-side pane, find "System cryptography: Use FIPS compliant algorithms for encryption, hashing, and signing".

If, in the Security Setting column, the value is "Disabled," this is a finding.

Check Content Reference

M

Target Key

2639

Comments