Azure SQL Database must use NSA-approved cryptography to protect classified information in accordance with the data owners requirements.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-255320	ASQL-00-003200	SV-255320r962034_rule		High

Description
Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. It is the responsibility of the data owner to assess the cryptography requirements in light of applicable federal laws, Executive Orders, directives, policies, regulations, and standards. NSA-approved cryptography for classified networks is hardware based. This requirement addresses the compatibility of Azure SQL Database with the encryption devices.

Description

Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the federal government since this provides assurance they have been tested and validated. It is the responsibility of the data owner to assess the cryptography requirements in light of applicable federal laws, Executive Orders, directives, policies, regulations, and standards. NSA-approved cryptography for classified networks is hardware based. This requirement addresses the compatibility of Azure SQL Database with the encryption devices.

STIG	Date
Microsoft Azure SQL Database Security Technical Implementation Guide	2024-06-10

Details

Check Text ( C-58993r877278_chk )
Use the TSQL query below to determine database encryption state: SELECT DB_NAME(database_id) AS DatabaseName, encryption_state_desc AS EncryptionState, key_algorithm+CAST(key_length AS nvarchar(128)) AS EncryptionAlgorithm, encryptor_type FROM sys.dm_database_encryption_keys Validate that for each database the [EncryptionState] is "ENCRYPTED" and the [EncryptionAlgorithm] returns one of the following values: [AES128], [AES192], or [AES256]. If any other value is returned for either the [EncryptionState] or [EncryptionAlgorithm], this is a finding.

Check Text ( C-58993r877278_chk )

Use the TSQL query below to determine database encryption state:

SELECT DB_NAME(database_id) AS DatabaseName,
encryption_state_desc AS EncryptionState,
key_algorithm+CAST(key_length AS nvarchar(128)) AS EncryptionAlgorithm,
encryptor_type
FROM sys.dm_database_encryption_keys

Validate that for each database the [EncryptionState] is "ENCRYPTED" and the [EncryptionAlgorithm] returns one of the following values: [AES128], [AES192], or [AES256].

If any other value is returned for either the [EncryptionState] or [EncryptionAlgorithm], this is a finding.

Fix Text (F-58937r871085_fix)
Use the ALTER DATABASE command to enable encryption on the database. ALTER DATABASE [Database Name Between Brackets] SET ENCRYPTION ON