SQL4-00-000100 - The number of concurrent SQL Server sessions for each system account must be limited.

800-53|AC-10

CAT|II

CCI|CCI-000054

Rule-ID|SV-213807r395442_rule

STIG-ID|SQL4-00-000100

STIG-Legacy|SV-82247

STIG-Legacy|V-67757

Vuln-ID|V-213807

SQL4-00-002010 - SQL Server must enforce approved authorizations for logical access to server-level system resources in accordance with applicable access control policies.

800-53|AC-3

CCI|CCI-000213

Rule-ID|SV-213808r395499_rule

STIG-ID|SQL4-00-002010

STIG-Legacy|SV-82251

STIG-Legacy|V-67761

Vuln-ID|V-213808

SQL4-00-010200 - SQL Server default account [sa] must have its name changed.

800-53|CM-7a.

CAT|III

CCI|CCI-000381

Rule-ID|SV-213809r395853_rule

STIG-ID|SQL4-00-010200

STIG-Legacy|SV-82345

STIG-Legacy|V-67855

Vuln-ID|V-213809

SQL4-00-011300 - Where SQL Server Trace is in use for auditing purposes, SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be traced.

800-53|AU-12b.

CCI|CCI-000171

Rule-ID|SV-213810r395709_rule

STIG-ID|SQL4-00-011300

STIG-Legacy|SV-82255

STIG-Legacy|V-67765

Vuln-ID|V-213810

SQL4-00-011310 - Where SQL Server Audit is in use, SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited at the server level.

Rule-ID|SV-213811r395709_rule

STIG-ID|SQL4-00-011310

STIG-Legacy|SV-82257

STIG-Legacy|V-67767

Vuln-ID|V-213811

SQL4-00-011410 - Where SQL Server Audit is in use, SQL Server must generate audit records when privileges/permissions are retrieved.

800-53|AU-12c.

CCI|CCI-000172

Rule-ID|SV-213812r395712_rule

STIG-ID|SQL4-00-011410

STIG-Legacy|SV-82259

STIG-Legacy|V-67769

Vuln-ID|V-213812

SQL4-00-011900 - SQL Server must produce Trace or Audit records containing sufficient information to establish when the events occurred.

800-53|AU-3

CCI|CCI-000131

Rule-ID|SV-213813r395724_rule

STIG-ID|SQL4-00-011900

STIG-Legacy|SV-82263

STIG-Legacy|V-67773

Vuln-ID|V-213813

SQL4-00-012000 - SQL Server must produce Trace or Audit records containing sufficient information to establish where the events occurred.

CCI|CCI-000132

Rule-ID|SV-213814r395727_rule

STIG-ID|SQL4-00-012000

STIG-Legacy|SV-82265

STIG-Legacy|V-67775

Vuln-ID|V-213814

SQL4-00-012100 - SQL Server must produce Trace or Audit records containing sufficient information to establish the sources (origins) of the events - origins of the events.

CCI|CCI-000133

Rule-ID|SV-213815r395730_rule

STIG-ID|SQL4-00-012100

STIG-Legacy|SV-82267

STIG-Legacy|V-67777

Vuln-ID|V-213815

SQL4-00-012200 - SQL Server must produce Trace or Audit records containing sufficient information to establish the outcome (success or failure) of the events - success/failure of the events.

CCI|CCI-000134

Rule-ID|SV-213816r395733_rule

STIG-ID|SQL4-00-012200

STIG-Legacy|SV-82269

STIG-Legacy|V-67779

Vuln-ID|V-213816

SQL4-00-012300 - SQL Server must produce Trace or Audit records containing sufficient information to establish the identity of any user/subject associated with the event.

CCI|CCI-001487

Rule-ID|SV-213817r395736_rule

STIG-ID|SQL4-00-012300

STIG-Legacy|SV-82271

STIG-Legacy|V-67781

Vuln-ID|V-213817

SQL4-00-012400 - SQL Server must include organization-defined additional, more detailed information in Trace or Audit records for events identified by type, location, or subject.

800-53|AU-3(1)

CCI|CCI-000135

Rule-ID|SV-213818r395739_rule

STIG-ID|SQL4-00-012400

STIG-Legacy|SV-82273

STIG-Legacy|V-67783

Vuln-ID|V-213818

SQL4-00-013000 - Unless it has been determined that availability is paramount, SQL Server must shut down upon the failure of an Audit, or a Trace used for auditing purposes, to include the unavailability of space for more audit/trace log records.

800-53|AU-5b.

CCI|CCI-000140

Rule-ID|SV-213819r395805_rule

STIG-ID|SQL4-00-013000

STIG-Legacy|SV-82275

STIG-Legacy|V-67785

Vuln-ID|V-213819

SQL4-00-013600 - The audit information produced by SQL Server must be protected from unauthorized read access.

800-53|AU-9

CCI|CCI-000162

Rule-ID|SV-213820r810820_rule

STIG-ID|SQL4-00-013600

STIG-Legacy|SV-82279

STIG-Legacy|V-67789

Vuln-ID|V-213820

SQL4-00-013700 - The audit information produced by  SQL Server must be protected from unauthorized modification.

CCI|CCI-000163

Rule-ID|SV-213821r395823_rule

STIG-ID|SQL4-00-013700

STIG-Legacy|SV-82281

STIG-Legacy|V-67791

Vuln-ID|V-213821

SQL4-00-013800 - The audit information produced by SQL Server must be protected from unauthorized deletion.

CCI|CCI-000164

Rule-ID|SV-213822r395826_rule

STIG-ID|SQL4-00-013800

STIG-Legacy|SV-82283

STIG-Legacy|V-67793

Vuln-ID|V-213822

SQL4-00-013900 - Audit tools used in, or in conjunction with, SQL Server must be protected from unauthorized access.

CCI|CCI-001493

Rule-ID|SV-213823r395829_rule

STIG-ID|SQL4-00-013900

STIG-Legacy|SV-82285

STIG-Legacy|V-67795

Vuln-ID|V-213823

SQL4-00-015300 - SQL Server security-relevant configuration settings must be monitored to discover unauthorized changes.

800-53|CM-5(6)

CCI|CCI-001499

Rule-ID|SV-213826r395850_rule

STIG-ID|SQL4-00-015300

STIG-Legacy|SV-82299

STIG-Legacy|V-67809

Vuln-ID|V-213826

SQL4-00-016200 - SQL Server must have the publicly available Northwind sample database removed.

Rule-ID|SV-213830r395853_rule

STIG-ID|SQL4-00-016200

STIG-Legacy|SV-82307

STIG-Legacy|V-67817

Vuln-ID|V-213830

SQL4-00-016300 - SQL Server must have the publicly available pubs sample database removed.

Rule-ID|SV-213831r395853_rule

STIG-ID|SQL4-00-016300

STIG-Legacy|SV-82309

STIG-Legacy|V-67819

Vuln-ID|V-213831

SQL4-00-016310 - SQL Server must have the publicly available AdventureWorks sample database removed.

Rule-ID|SV-213832r395853_rule

STIG-ID|SQL4-00-016310

STIG-Legacy|SV-82311

STIG-Legacy|V-67821

Vuln-ID|V-213832

SQL4-00-016835 - SQL Server must have the Data Quality Services software component removed if it is unused.

Rule-ID|SV-213843r395853_rule

STIG-ID|SQL4-00-016835

STIG-Legacy|SV-82333

STIG-Legacy|V-67843

Vuln-ID|V-213843

SQL4-00-016855 - SQL Server must have the Filestream feature disabled if it is unused.

Rule-ID|SV-213846r395853_rule

STIG-ID|SQL4-00-016855

STIG-Legacy|SV-82339

STIG-Legacy|V-67849

Vuln-ID|V-213846

SQL4-00-017000 - Unused database components that are integrated in SQL Server and cannot be uninstalled must be disabled.

Rule-ID|SV-213847r395853_rule

STIG-ID|SQL4-00-017000

STIG-Legacy|SV-82341

STIG-Legacy|V-67851

Vuln-ID|V-213847

SQL4-00-017100 - The SQL Server default account [sa] must be disabled.

Rule-ID|SV-213848r395853_rule

STIG-ID|SQL4-00-017100

STIG-Legacy|SV-82343

STIG-Legacy|V-67853

Vuln-ID|V-213848

SQL4-00-017200 - Access to xp_cmdshell must be disabled, unless specifically required and approved.

Rule-ID|SV-213849r395853_rule

STIG-ID|SQL4-00-017200

STIG-Legacy|SV-82347

STIG-Legacy|V-67857

Vuln-ID|V-213849

SQL4-00-017400 - SQL Server must be configured to prohibit or restrict the use of unauthorized network protocols.

800-53|CM-7b.

CCI|CCI-000382

Rule-ID|SV-213850r744320_rule

STIG-ID|SQL4-00-017400

STIG-Legacy|SV-82349

STIG-Legacy|V-67859

Vuln-ID|V-213850

SQL4-00-017410 - SQL Server must be configured to prohibit or restrict the use of unauthorized network ports.

Rule-ID|SV-213851r810821_rule

STIG-ID|SQL4-00-017410

STIG-Legacy|SV-82351

STIG-Legacy|V-67861

Vuln-ID|V-213851

SQL4-00-018400 - SQL Server must uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users) - or processes acting on behalf of organizational users.

800-53|IA-2

Detections

Analytics

DISA STIG SQL Server 2014 Instance DB Audit v2r3

Audit Details

File Details

Audit Changelog

No revisions found