Detections
Analytics

SQL6-D0-013400 - SQL Server must generate audit records when successful and unsuccessful attempts to add privileges/permissions occur.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected. Elevated privileges give users access to information and functionality that they should not have; restricted privileges wrongly deny access to authorized users.

In an SQL environment, adding permissions is typically done via the GRANT command, or, in the negative, the DENY command.

To aid in diagnosis, it is necessary to keep track of failed attempts in addition to the successful ones.

Satisfies: SRG-APP-000495-DB-000326

Solution

Add the following events to the SQL Server Audit that is being used for the STIG compliant audit.

DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP
DATABASE_OBJECT_PERMISSION_CHANGE_GROUP
DATABASE_OWNERSHIP_CHANGE_GROUP
DATABASE_PERMISSION_CHANGE_GROUP
DATABASE_ROLE_MEMBER_CHANGE_GROUP
SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP
SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP
SERVER_OBJECT_OWNERSHIP_CHANGE_GROUP
SERVER_OBJECT_PERMISSION_CHANGE_GROUP
SERVER_PERMISSION_CHANGE_GROUP
SERVER_ROLE_MEMBER_CHANGE_GROUP

See the supplemental file 'SQL 2016 Audit.sql'.

Reference:
https://msdn.microsoft.com/en-us/library/cc280663.aspx

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_MS_SQL_Server_2016_Y25M07_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000172, Rule-ID|SV-214000r961800_rule, STIG-ID|SQL6-D0-013400, STIG-Legacy|SV-93967, STIG-Legacy|V-79261, Vuln-ID|V-214000

Plugin: MS_SQLDB

Control ID: 31c562188ad011886e0400cec94f2a884693044dd4e758f8bb7bca395bf158e9