MS SQL Server 2014 Instance Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-APP-000503-DB-000350
<GroupDescription></GroupDescription>Group -
SQL Server must generate Trace or Audit records when successful logons or connections occur.
<VulnDiscussion>For completeness of forensic analysis, it is necessary to track who/what (a user or other principal) logs on to SQL Server. ...Rule Medium Severity -
SRG-APP-000503-DB-000351
<GroupDescription></GroupDescription>Group -
SQL Server must generate Trace or Audit records when unsuccessful logons or connection attempts occur.
<VulnDiscussion>For completeness of forensic analysis, it is necessary to track failed attempts to log on to SQL Server. While positive ident...Rule Medium Severity -
SRG-APP-000504-DB-000354
<GroupDescription></GroupDescription>Group -
SQL Server must generate Trace or Audit records for all privileged activities or other system-level access.
<VulnDiscussion>Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to a...Rule Medium Severity -
SRG-APP-000504-DB-000355
<GroupDescription></GroupDescription>Group -
SQL Server must generate Trace or Audit records when unsuccessful attempts to execute privileged activities or other system-level access occur.
<VulnDiscussion>Without tracking privileged activity, it would be difficult to establish, correlate, and investigate the events relating to a...Rule Medium Severity -
SRG-APP-000505-DB-000352
<GroupDescription></GroupDescription>Group -
SQL Server must generate Trace or Audit records when logoffs or disconnections occur.
<VulnDiscussion>For completeness of forensic analysis, it is necessary to track who/what (a user or other principal) logs on to and off from ...Rule Medium Severity -
SRG-APP-000506-DB-000353
<GroupDescription></GroupDescription>Group -
SQL Server must generate Trace or Audit records when concurrent logons/connections by the same user from different workstations occur.
<VulnDiscussion>For completeness of forensic analysis, it is necessary to track who logs on to SQL Server. Concurrent connections by the sam...Rule Medium Severity -
SRG-APP-000515-DB-000318
<GroupDescription></GroupDescription>Group -
SQL Server must off-load audit data to a separate log management facility; this must be continuous and in near real time for systems with a network connection to the storage facility and weekly or more often for stand-alone systems.
<VulnDiscussion>Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common...Rule Medium Severity -
SRG-APP-000164-DB-000401
<GroupDescription></GroupDescription>Group -
If SQL Server authentication, using passwords, is employed, SQL Server must enforce the DoD standards for password complexity.
<VulnDiscussion>Windows domain/enterprise authentication and identification must be used (SQL4-00-030300). Native SQL Server authentication ...Rule Medium Severity -
SRG-APP-000164-DB-000401
<GroupDescription></GroupDescription>Group -
If SQL Server authentication, using passwords, is employed, SQL Server must enforce the DoD standards for password lifetime.
<VulnDiscussion>Windows domain/enterprise authentication and identification must be used (SQL4-00-030300). Native SQL Server authentication ...Rule Medium Severity -
SRG-APP-000178-DB-000083
<GroupDescription></GroupDescription>Group -
Applications must obscure feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.
<VulnDiscussion>To prevent the compromise of authentication information, such as passwords and PINs, during the authentication process, the f...Rule High Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.