DISA_STIG_MSSQL_2012_Instance-OS_v1r20.audit from DISA Microsoft SQL Server Instance 2012 v1r20 STIG

SQL2-00-008900 - SQL Server processes or services must run under custom, dedicated OS or domain accounts - 'SQL Full-text Filter Daemon Launcher'

800-53|AC-5c.

800-53|CM-6b.

CAT|II

CCI|CCI-000366

CCI|CCI-002220

Rule-ID|SV-53422r4_rule

STIG-ID|SQL2-00-008900

Vuln-ID|V-41047

SQL2-00-008900 - SQL Server processes or services must run under custom, dedicated OS or domain accounts - 'SQL Server Agent'

SQL2-00-008900 - SQL Server processes or services must run under custom, dedicated OS or domain accounts - 'SQL Server Analysis Services'

SQL2-00-008900 - SQL Server processes or services must run under custom, dedicated OS or domain accounts - 'SQL Server Browser'

SQL2-00-008900 - SQL Server processes or services must run under custom, dedicated OS or domain accounts - 'SQL Server Distributed Replay Client'

SQL2-00-008900 - SQL Server processes or services must run under custom, dedicated OS or domain accounts - 'SQL Server Distributed Replay Controller'

SQL2-00-008900 - SQL Server processes or services must run under custom, dedicated OS or domain accounts - 'SQL Server Integration Services 11.0'

SQL2-00-008900 - SQL Server processes or services must run under custom, dedicated OS or domain accounts - 'SQL Server Reporting Services'

SQL2-00-008900 - SQL Server processes or services must run under custom, dedicated OS or domain accounts - 'SQL Server VSS Writer'

SQL2-00-008900 - SQL Server processes or services must run under custom, dedicated OS or domain accounts - 'SQL Server'

SQL2-00-009100 - A single SQL Server database connection configuration file (or a single set of credentials) must not be used to configure all database clients - or a single set of credentials must not be used to configure all clients.

Rule-ID|SV-53420r2_rule

STIG-ID|SQL2-00-009100

Vuln-ID|V-41045

SQL2-00-009900 - OS and domain accounts utilized to run external procedures called by SQL Server must have limited privileges.

Rule-ID|SV-53415r3_rule

STIG-ID|SQL2-00-009900

Vuln-ID|V-41040

SQL2-00-010000 - DBA OS or domain accounts must be granted only those host system privileges necessary for the administration of SQL Server.

Rule-ID|SV-53414r4_rule

STIG-ID|SQL2-00-010000

Vuln-ID|V-41039

SQL2-00-010100 - Use of the SQL Server software installation account must be restricted to SQL Server software installation.

Rule-ID|SV-53413r2_rule

STIG-ID|SQL2-00-010100

Vuln-ID|V-41038

SQL2-00-010600 - SQL Server must have allocated audit record storage capacity to meet the organization-defined requirements for saving audit record information.

800-53|AU-4

CCI|CCI-001849

Rule-ID|SV-53401r2_rule

STIG-ID|SQL2-00-010600

Vuln-ID|V-41026

SQL2-00-013600 - SQL Server must protect audit information from any type of unauthorized access.

800-53|AU-9

CCI|CCI-000162

Rule-ID|SV-53390r5_rule

STIG-ID|SQL2-00-013600

Vuln-ID|V-41016

SQL2-00-013700 - SQL Server must protect audit information from unauthorized modification.

CAT|III

CCI|CCI-000163

Rule-ID|SV-53307r5_rule

STIG-ID|SQL2-00-013700

Vuln-ID|V-40953

SQL2-00-013800 - SQL Server must protect audit information from unauthorized deletion.

CCI|CCI-000164

Rule-ID|SV-53306r4_rule

STIG-ID|SQL2-00-013800

Vuln-ID|V-40952

SQL2-00-014400 - SQL Server must protect the audit records generated as a result of remote access to privileged accounts and by the execution of privileged functions.

800-53|AU-9(4)

CCI|CCI-001351

Rule-ID|SV-53391r4_rule

STIG-ID|SQL2-00-014400

Vuln-ID|V-41017

SQL2-00-014600 - SQL Server must support the organizational requirement to employ automated mechanisms for enforcing access restrictions.

800-53|CM-5(1)

CCI|CCI-001813

Rule-ID|SV-53305r2_rule

STIG-ID|SQL2-00-014600

Vuln-ID|V-40951

SQL2-00-014700 - SQL Server must support the employment of automated mechanisms supporting the auditing of the enforcement actions.

CCI|CCI-001814

Rule-ID|SV-53304r3_rule

STIG-ID|SQL2-00-014700

Vuln-ID|V-40950

SQL2-00-015350 - Software, applications, and configuration files that are part of, or related to, the SQL Server 2012 installation must be monitored to discover unauthorized changes.

800-53|SI-7(6)

CAT|I

CCI|CCI-001493

CCI|CCI-001494

CCI|CCI-001495

CCI|CCI-002716

CCI|CCI-002718

Rule-ID|SV-53302r5_rule

STIG-ID|SQL2-00-015350

Vuln-ID|V-40948

SQL2-00-015355 - Software, applications, and configuration files that are part of, or related to, the SQL Server 2012 installation must be audited.

CCI|CCI-002717

Rule-ID|SV-83773r1_rule

STIG-ID|SQL2-00-015355

Vuln-ID|V-69169

SQL2-00-015400 - SQL Server software installation account(s) must be restricted to authorized users.

800-53|CM-5(6)

CCI|CCI-001499

Rule-ID|SV-53301r2_rule

STIG-ID|SQL2-00-015400

Vuln-ID|V-40947

SQL2-00-015500 - Database software directories, including SQL Server configuration files, must be stored in dedicated directories, separate from the host OS and other applications.

Rule-ID|SV-53300r4_rule

STIG-ID|SQL2-00-015500

Vuln-ID|V-40946

SQL2-00-015800 - The OS must limit privileges to change SQL Server software resident within software libraries (including privileged programs) - '\110\Shared'

Rule-ID|SV-53298r8_rule

STIG-ID|SQL2-00-015800

Vuln-ID|V-40944

SQL2-00-015800 - The OS must limit privileges to change SQL Server software resident within software libraries (including privileged programs) - 'binn'

SQL2-00-015800 - The OS must limit privileges to change SQL Server software resident within software libraries (including privileged programs) - 'Install'

SQL2-00-016500 - SQL Server must have the SQL Server Data Tools (SSDT) software component removed from SQL Server if SSDT is unused.

800-53|CM-7a.

CCI|CCI-000381

Rule-ID|SV-53295r2_rule

STIG-ID|SQL2-00-016500

Vuln-ID|V-40941

SQL2-00-016600 - SQL Server must have the SQL Server Reporting Service (SSRS) software component removed from SQL Server if SSRS is unused.

Rule-ID|SV-53294r2_rule

STIG-ID|SQL2-00-016600

Vuln-ID|V-40940

SQL2-00-016700 - SQL Server must have the SQL Server Integrated Services (SSIS) software component removed from SQL Server if SSIS is unused.

Rule-ID|SV-53293r2_rule

STIG-ID|SQL2-00-016700

Vuln-ID|V-40939

SQL2-00-016800 - SQL Server must have the SQL Server Analysis Service (SSAS) software component removed from SQL Server if SSAS is unused.

Rule-ID|SV-53292r2_rule

STIG-ID|SQL2-00-016800

Vuln-ID|V-40938

SQL2-00-020100 - SQL Server must protect the integrity of publicly available information and applications.

Rule-ID|SV-53269r3_rule

STIG-ID|SQL2-00-020100

Vuln-ID|V-40915

SQL2-00-025100 - The OS must limit privileges to the SQL Server Data Root directory and its subordinate directories and files.

Rule-ID|SV-69105r5_rule

STIG-ID|SQL2-00-025100

Vuln-ID|V-54859

SQL2-00-025200 - The OS must limit privileges to the SQL Server data directories and their subordinate directories and files.

Rule-ID|SV-69125r3_rule

STIG-ID|SQL2-00-025200

Vuln-ID|V-54879

SQL2-00-025300 - The OS must limit privileges to the SQL Server backup directories and files.

Rule-ID|SV-69127r4_rule

STIG-ID|SQL2-00-025300

Vuln-ID|V-54881

SQL2-00-039100 - The SQL Server Browser service must be disabled if its use is not necessary.

Detections

Analytics

Revision 1.2

Jan 12, 2021

Informational Update

Miscellaneous