Detections
Analytics
SQL2-00-020300 - SQL Server must protect the integrity of publicly available information and SQL Servers configuration from unauthorized Server Roles access.
Information
The purpose of this control is to ensure organizations explicitly address the protection needs for public information and applications, with such protection likely being implemented as part of other security controls. If SQL Server contains publicly available information, though not concerned with confidentiality, SQL Server must maintain the integrity of the data. If data available to the public is not protected from unauthorized modification or deletion, then the data cannot be trusted by those accessing it.The user account associated with public access must not have access to the OS or SQL Server configuration information, include read access to schema information.
This requirement is not intended to prevent the establishment of public-facing systems for the purpose of collecting data from the public.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Navigate to SQL Server Management Studio >> Object Explorer >> <'SQL Server name'> >> Security >> Logins >> right click <'user account'> >> Properties >> Server Roles.Uncheck the 'Server Roles' that are checked and grant more than read-only access to the publicly available information.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_SQL_Server_2012_V1R20_STIG.zip
Item Details
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-53267r3_rule, STIG-ID|SQL2-00-020300, Vuln-ID|V-40913
Plugin: MS_SQLDB
Control ID: 687bc56ea1cbe65998049b304613852ee00f23d2db6255468390c42c891c0ad7