Application objects should be owned by accounts authorized for ownership.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-15607	DG0008-SQLServer9	SV-24068r2_rule	ECLP-1	Medium

Description
Database object ownership implies full privileges to the owned object including the privilege to assign access to the owned objects to other subjects. Unmanaged or uncontrolled ownership of objects can lead to unauthorized object grants and alterations.

STIG	Date
Microsoft SQL Server 2005 Database Security Technical Implementation Guide	2015-06-16

Details

Check Text ( C-23671r2_chk )
From the query prompt: SELECT name AS [Database Name] FROM [master].sys.databases WHERE state = 0 Repeat for each database: From the query prompt: USE [Database Name] SELECT DISTINCT s.name AS [Schema Name], u.name AS [Principal], u.type_desc AS [Type] FROM sys.schemas s JOIN sys.database_principals u ON s.principal_id = u.principal_id JOIN sys.all_objects o ON s.schema_id = o.schema_id WHERE u.name NOT IN ('dbo', 'INFORMATION_SCHEMA', 'sys') ORDER BY s.name, u.name Review the object ownerships listed. Verify any listed accounts are authorized application installation accounts and documented in the System Security Plan. If any accounts are not authorized, this is a Finding. If any authorized accounts listed are not documented in the System Security Plan, this is a Finding.

Check Text ( C-23671r2_chk )

From the query prompt:

SELECT name AS [Database Name]
FROM [master].sys.databases
WHERE state = 0

Repeat for each database:

From the query prompt:

USE [Database Name]
SELECT DISTINCT s.name AS [Schema Name], u.name AS [Principal], u.type_desc AS [Type]
FROM sys.schemas s
JOIN sys.database_principals u ON s.principal_id = u.principal_id
JOIN sys.all_objects o ON s.schema_id = o.schema_id
WHERE u.name NOT IN ('dbo', 'INFORMATION_SCHEMA', 'sys')
ORDER BY s.name, u.name

Review the object ownerships listed. Verify any listed accounts are authorized application installation accounts and documented in the System Security Plan.

If any accounts are not authorized, this is a Finding.

If any authorized accounts listed are not documented in the System Security Plan, this is a Finding.

Fix Text (F-17828r1_fix)
Create database accounts dedicated for application object ownership. To simplify access authorizations, use a single account for each application to avoid cross chaining of ownership, which makes security configuration more complex and degrades system performance. Document all application object ownership in the System Security Plan and authorize with the IAO.