Detections
Analytics
SQL2-00-008800 - SQL Server must enforce separation of duties through assigned information access authorizations - 'user defined roles'
Information
Separation of duties is a prevalent Information Technology control that is implemented at different layers of the information system, including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires that the person accountable for approving an action is not the same person who is tasked with implementing or carrying out that action.Additionally, the person or entity accountable for monitoring the activity must be separate as well. To meet this requirement, applications, when applicable, shall be divided where functionality is based on roles and duties. Examples of separation of duties include: (i) mission functions and distinct information system support functions are divided among different individuals/roles; (ii) different individuals perform information system support functions (e.g., system management, systems programming, configuration management, quality assurance and testing, network security); (iii) security personnel who administer access control functions do not administer audit functions; and (iv) different administrator accounts for different roles.
Privileges granted outside the role of the application user job function are more likely to go unmanaged or without oversight for authorization. Maintenance of privileges using roles defined for discrete job functions offers improved oversight of application user privilege assignments and helps to protect against unauthorized privilege assignment.
Solution
Add the user-defined server role to the system documentation.Add the assigned privileges of the user-defined server role to the system documentation.
Remove the user from direct access to server permission by running the following script:
USE master
REVOKE <'server permission name'> TO <'account name'> CASCADE
Remove server role permission from the user-defined server role by running the following script:
USE master
REVOKE <'server role name'> TO [<'server role name'>]
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_SQL_Server_2012_V1R20_STIG.zip
Item Details
Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT
References: 800-53|AC-5c., 800-53|CM-6b., CAT|II, CCI|CCI-000366, CCI|CCI-002220, Rule-ID|SV-53669r4_rule, STIG-ID|SQL2-00-008800, Vuln-ID|V-41202
Plugin: MS_SQLDB
Control ID: e560f5ceee28ecbc0f9a5d3021a30c4931dc3d5b54c552e7a4239785b2d20e4b