SQL6-D0-001400 - The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to SQL Server, etc.) must be restricted to authorized users.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

Information

If SQL Server were to allow any user to make changes to database structure or logic, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process.

Accordingly, only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.

Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Document and obtain approval for any non-administrative users who require the ability to modify database structure and logic modules.

REVOKE ALTER ON [<Object Name>] TO [<Principal Name>]

Item Details

Audit Name: DISA MS SQL Server 2016 Database STIG v3r3

Plugin: MS_SQLDB

Control ID: 9cca99e3865f8e43a5f1243e7e4d1c3434e126e4f8852c3b47da82b3e9cf0065

Detections

Analytics

SQL6-D0-001400 - The role(s)/group(s) used to modify database structure (including but not necessarily limited to tables, indexes, storage, etc.) and logic modules (stored procedures, functions, triggers, links to software external to SQL Server, etc.) must be restricted to authorized users.

Warning! Audit Deprecated

Information

Solution

See Also

Item Details