Detections
Analytics
SQL2-00-010200 - SQL Server default account sa must have its name changed.
Information
SQL Server's 'sa' account has special privileges required to administer the database. The 'sa' account is a well-known SQL Server account name and is likely to be targeted by attackers, and is thus more prone to providing unauthorized access to the database.Since the SQL Server 'sa' is administrative in nature, the compromise of a default account can have catastrophic consequences, including the complete loss of control over SQL Server. Since SQL Server needs for this account to exist and it should not be removed, one way to mitigate this risk is to change the 'sa' account name.
Solution
Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Logins >> click 'sa' account name.Hit <F2> while the name is highlighted in order to edit the name.
Rename the 'sa' account.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_SQL_Server_2012_V1R20_STIG.zip
Item Details
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-53412r2_rule, STIG-ID|SQL2-00-010200, Vuln-ID|V-41037
Plugin: MS_SQLDB
Control ID: acafc3ce9791e79d6e75b762c3a901925c2534457149ac99a90b51f67d0dcf9c