DBMS symmetric keys should be protected in accordance with NSA or NIST-approved key management technology or processes.

DBMS symmetric keys should be protected in accordance with NSA or NIST-approved key management technology or processes.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-15654	DG0165-SQLServer9	SV-21488r1_rule	IAKM-1 IAKM-2 IAKM-3	Medium

Description
Symmetric keys used for encryption protect data from unauthorized access. However, if not protected in accordance with acceptable standards, the keys themselves may be compromised and used for unauthorized data access.

STIG	Date
Microsoft SQL Server 2005 Database Security Technical Implementation Guide	2015-04-03

Details

Check Text ( None )
None

Fix Text (F-20181r1_fix)
Document all users authorized to access the database master key in the System Security Plan. Restrict authorized users to the application, database owner and SYSADMINs. For each unauthorized user: From the query prompt: REVOKE CONTROL FROM [user name]