Detections
Analytics

1.65 SQLI-22-016500

Information

The SQL Server Mirroring endpoint must use AES encryption.

GROUP ID: V-274447
RULE ID: SV-274447r1111109

Information can be unintentionally or maliciously disclosed or modified during preparation for transmission, including, for example, during aggregation, at protocol transformation points, and during packing/unpacking. These unauthorized disclosures or modifications compromise the confidentiality or integrity of the information.

Use of this requirement will be limited to situations where the data owner has a strict requirement for ensuring data integrity and confidentiality is maintained at every step of the data transfer and handling process.

SQL Mirroring endpoints support different encryption algorithms, including no-encryption. Using a weak encryption algorithm or plaintext in communication protocols can lead to data loss, data manipulation, and/or connection hijacking.

Solution

Run the following to enable encryption on the mirroring endpoint:

ALTER ENDPOINT <Endpoint Name>
FOR DATABASE_MIRRORING
(ENCRYPTION = REQUIRED ALGORITHM AES)

See Also

https://workbench.cisecurity.org/benchmarks/26144

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-274447r1111109_rule, STIG-ID|SQLI-22-016500, Vuln-ID|V-274447

Plugin: MS_SQLDB

Control ID: 9ba4455dc8dcb96413032fe0498266083872f0dcb8cda66d2eed17f7d7784efc