II - Mission Support Sensitive
Rules and Groups employed by this XCCDF Profile
-
SRG-APP-000033-DB-000084
Group -
SQL Server must enforce approved authorizations for logical access to information and database-level system resources in accordance with applicable access control policies.
Authentication with a DoD-approved PKI certificate does not necessarily imply authorization to access the database and all its contents. To mitigate the risk of unauthorized access to sensitive in...Rule Medium Severity -
SRG-APP-000089-DB-000064
Group -
SQL Server must generate Trace or Audit records for organization-defined auditable events.
Audit records can be generated from various components within the information system (e.g., network interface, hard disk, modem, etc.). From an application perspective, certain specific application...Rule Medium Severity -
SRG-APP-000090-DB-000065
Group -
Where SQL Server Audit is in use at the database level, SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited at the database level.
Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent or interfere with the auditing of critical events. ...Rule Medium Severity -
SRG-APP-000133-DB-000179
Group -
SQL Server must be monitored to discover unauthorized changes to functions.
When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of SQL Server and/or application can potentially have significant effe...Rule Medium Severity -
SRG-APP-000133-DB-000179
Group -
SQL Server must be monitored to discover unauthorized changes to triggers.
When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of SQL Server and/or application can potentially have significant effe...Rule Medium Severity -
SRG-APP-000133-DB-000179
Group -
SQL Server must be monitored to discover unauthorized changes to stored procedures.
When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of SQL Server and/or application can potentially have significant effe...Rule Medium Severity -
SRG-APP-000133-DB-000200
Group -
Database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to SQL Server, etc.) must be owned by database/DBMS principals authorized for ownership.
Within the database, object ownership implies full privileges to the owned object, including the privilege to assign access to the owned objects to other subjects. Database functions and procedures...Rule Medium Severity -
SRG-APP-000133-DB-000200
Group -
In a database owned by a login not having administrative privileges at the instance level, the database property TRUSTWORTHY must be OFF unless required and authorized.
SQL Server's fixed (built-in) server roles, especially [sysadmin], have powerful capabilities that could cause great harm if misused, so their use must be tightly controlled. The SQL Server instan...Rule Medium Severity -
SRG-APP-000133-DB-000200
Group -
In a database owned by [sa], or by any other login having administrative privileges at the instance level, the database property TRUSTWORTHY must be OFF.
SQL Server's fixed (built-in) server roles, especially [sysadmin], have powerful capabilities that could cause great harm if misused, so their use must be tightly controlled. The SQL Server instan...Rule Medium Severity -
SRG-APP-000226-DB-000147
Group -
In the event of a system failure, SQL Server must preserve any information necessary to return to operations with least disruption to mission processes.
Failure to a known state can address safety or security in accordance with the mission/business needs of the organization. The existence and reliability of database backups is an essential aspect o...Rule Medium Severity -
SRG-APP-000231-DB-000154
Group -
The Database Master Key must be encrypted by the Service Master Key, where a Database Master Key is required and another encryption method has not been specified.
When not encrypted by the Service Master Key, system administrators or application administrators may access and use the Database Master Key to view sensitive data that they are not authorized to v...Rule Medium Severity -
SRG-APP-000231-DB-000154
Group -
Database Master Key passwords must not be stored in credentials within the database.
Storage of the Database Master Key password in a database credential allows decryption of sensitive data by privileged users who may not have a need-to-know requirement to access the data.Rule Medium Severity -
SRG-APP-000231-DB-000154
Group -
Symmetric keys (other than the database master key) must use a DoD certificate to encrypt the key.
Data within the database is protected by use of encryption. The symmetric keys are critical for this process. If the symmetric keys were to be compromised the data could be disclosed to unauthorize...Rule Medium Severity -
SRG-APP-000243-DB-000128
Group -
Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy.
The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf...Rule Medium Severity -
SRG-APP-000251-DB-000160
Group -
SQL Server must check the validity of all data inputs except those specifically identified by the organization.
Invalid user input occurs when a user inserts data or characters into an application’s data entry fields and the application is unprepared to process that data. This results in unanticipated applic...Rule Medium Severity -
SRG-APP-000251-DB-000391
Group -
The DBMS and associated applications must reserve the use of dynamic code execution for situations that require it.
With respect to database management systems, one class of threat is known as SQL Injection, or more generally, code injection. It takes advantage of the dynamic execution capabilities of various pr...Rule Medium Severity -
SRG-APP-000251-DB-000392
Group -
The DBMS and associated applications, when making use of dynamic code execution, must scan input data for invalid values that may indicate a code injection attack.
With respect to database management systems, one class of threat is known as SQL Injection, or more generally, code injection. It takes advantage of the dynamic execution capabilities of various pr...Rule Medium Severity -
SRG-APP-000266-DB-000162
Group -
The DBMS and associated applications must provide non-privileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.
Any DBMS or associated application providing too much information in error messages on the screen or printout risks compromising the data and security of the system. The structure and content of er...Rule Medium Severity -
SRG-APP-000267-DB-000163
Group -
SQL Server must reveal detailed error messages only to the ISSO, ISSM (or their designees), SA and DBA.
If the DBMS provides too much information in error logs and administrative messages to the screen, this could lead to compromise. The structure and content of error messages need to be carefully co...Rule Medium Severity -
SRG-APP-000311-DB-000308
Group -
When supporting applications that require security labeling of data, SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in storage.
Without the association of security labels to information, there is no basis for the DBMS to make security-related access-control decisions. Security labels are abstractions representing the basic...Rule Medium Severity -
SRG-APP-000313-DB-000309
Group -
When supporting applications that require security labeling of data, SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in process.
Without the association of security labels to information, there is no basis for the DBMS to make security-related access-control decisions. Security labels are abstractions representing the basic...Rule Medium Severity -
SRG-APP-000314-DB-000310
Group -
When supporting applications that require security labeling of data, SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in transmission.
Without the association of security labels to information, there is no basis for the DBMS to make security-related access-control decisions. Security labels are abstractions representing the basic...Rule Medium Severity -
SRG-APP-000375-DB-000323
Group -
Time stamps in database tables, intended for auditing or activity-tracking purposes, must include both date and time of day, with a minimum granularity of one second.
If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis, in audit files, trace files/tables, and application data tables. Ti...Rule Medium Severity -
SRG-APP-000428-DB-000386
Group -
SQL Server must implement and/or support cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components.
Databases holding data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. These cryptographic ...Rule Medium Severity -
SRG-APP-000447-DB-000393
Group -
When invalid inputs are received, SQL Server must behave in a predictable and documented manner that reflects organizational and system objectives.
A common vulnerability is unplanned behavior when invalid inputs are received. This requirement guards against adverse or unintended system behavior caused by invalid inputs, where information syst...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.