Detections
Analytics

3.4 Ensure SQL Authentication is not used in contained databases

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Contained databases do not enforce password complexity rules for SQL Authenticated users.

The absence of an enforced password policy may increase the likelihood of a weak credential being established in a contained database.

Solution

Leverage Windows Authenticated users in contained databases.

Impact:

While contained databases provide flexibility in relocating databases to different instances and different environments, this must be balanced with the consideration that no password policy mechanism exists for SQL Authenticated users in contained databases.

See Also

https://workbench.cisecurity.org/benchmarks/24175

Item Details

References: CSCv7|16.2

Plugin: MS_SQLDB

Control ID: df67aca7e76f175338c48bf890aa83b6cb284c5c6a5f4fc0ab3546e1ad76c2d2