SQL2-00-019600 - SQL Server databases in the classified environment, containing classified or sensitive information, must be encrypted using approved cryptography.

Information

Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data.

Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data.

Data files that are not encrypted are vulnerable to theft. When data files are not encrypted, they can be copied and opened on a separate system. The data can be compromised without the information owner's knowledge that the theft has even taken place.

NSA has developed Type 1 algorithms for protecting classified information. The Committee on National Security Systems (CNSS) National Information Assurance Glossary (CNSS Instruction No. 4009) defines Type 1 products as:
'Cryptographic equipment, assembly or component classified or certified by NSA for encrypting and decrypting classified and sensitive national security information when appropriately keyed.
Developed using established NSA business processes and containing NSA approved algorithms are used to protect systems requiring the most stringent protection mechanisms.'

NSA-approved cryptography is required to be used for classified information system processing.

See FIPS Publication 140-2 and related documents for guidance on approved encryption techniques and certified encryption modules.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Configure SQL Server to encrypt sensitive or classified data stored in each database. Use only NIST-certified or NSA-approved cryptography to provide encryption.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_SQL_Server_2012_V1R20_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-13, CAT|I, CCI|CCI-002450, Rule-ID|SV-53271r4_rule, STIG-ID|SQL2-00-019600, Vuln-ID|V-40917

Plugin: MS_SQLDB

Control ID: ae9e9b39553d651f97a133be05546c71ecd10ce00271d7706d683feb6b765020