Detections
Analytics
SQL2-00-008500 - SQL Server must enforce DAC policy allowing users to specify and control sharing by named individuals, groups of individuals, or by both; limiting propagation of access rights; and including or excluding access to the granularity of a single user - 'user defined roles'
Information
Access control policies (e.g., identity-based policies, role-based policies, attribute-based policies) and access enforcement mechanisms (e.g., access control lists, access control matrices, cryptography) are employed by organizations to control access between users (or processes acting on behalf of users) and objects (e.g., devices, files, records, processes, programs, domains).DAC is a type of access control methodology serving as a means of restricting access to objects and data based on the identity of subjects and/or groups to which they belong. It is discretionary in the sense that application users with the appropriate permissions to access an application resource or data have the discretion to pass that permission on to another user either directly or indirectly.
Data protection requirements may result in a DAC policy being specified as part of the application design. Discretionary access controls would be employed at the application level to restrict and control access to application objects and data, thereby providing increased information security for the organization.
When DAC controls are employed, those controls must limit sharing to named application users, groups of users, or both. The application DAC controls must also limit the propagation of access rights and have the ability to exclude access to data down to the granularity of a single user.
Databases using DAC must have the ability for the owner of an object or information to assign or revoke rights to view or modify the object or information. If the owner of an object or information does not have rights to exclude access to an object or information at a user level, users may gain access to objects and information they are not authorized to view/modify.
Solution
Add the user-defined server role to the system documentation.Add the user as a member of the user-defined server role within the system documentation.
Remove the user from direct access to server permission by running the following script:
USE master
REVOKE <'server permission name'> TO <'account name'> CASCADE
Remove the user from user-defined role access by running the following script:
USE master
ALTER SERVER ROLE [<'server role name'>] DROP MEMBER <'user name'>
Add the user-defined role access to the user by running the following script:
USE master
ALTER SERVER ROLE [<'server role name'>] ADD MEMBER <'user name'>
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_SQL_Server_2012_V1R20_STIG.zip
Item Details
Category: ACCESS CONTROL
References: 800-53|AC-3(4), CAT|II, CCI|CCI-002165, Rule-ID|SV-53672r3_rule, STIG-ID|SQL2-00-008500, Vuln-ID|V-41205
Plugin: MS_SQLDB
Control ID: 25458a6efab5683520d19e34f9ca544ed2d9c4f82f68f9805dfef07cf122cb9b