2.9 Ensure 'Trustworthy' Database Property is set to 'Off'

Information

The TRUSTWORTHY database option allows database objects to access objects in other databases under certain circumstances.

Rationale:

Provides protection from malicious CLR assemblies or extended procedures.

Solution

Execute the following T-SQL statement against the databases (replace <database_name> below) returned by the Audit Procedure:

ALTER DATABASE [<database_name>] SET TRUSTWORTHY OFF;

Default Value:

By default, this database property is OFF (is_trustworthy_on = 0), except for the msdb database in which it is required to be ON.

References:

https://docs.microsoft.com/en-us/sql/relational-databases/security/trustworthy-database-property

https://support.microsoft.com/it-it/help/2183687/guidelines-for-using-the-trustworthy-database-setting-in-sql-server

See Also

https://workbench.cisecurity.org/files/2837

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3, CSCv6|14.4, CSCv7|14.6

Plugin: MS_SQLDB

Control ID: 60ddddd69741b9fc2ca2a2af0e97349c1a46c9b592c13d661c30156ce903ea5d