The DBMS should not be operated without authorization on a host system supporting other application services.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-15146	DG0109-SQLServer9	SV-24278r1_rule	DCPA-1	Medium

Description
In the same way that added security layers can provide a cumulative positive effect on security posture, multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit to one application can lead to an exploit of other applications sharing the same security context. For example, an exploit to a web server process that leads to unauthorized administrative access to the host system can most likely lead to a compromise of all applications hosted by the same system. A DBMS not installed on a dedicated host may pose a threat to and be threatened by other hosted applications. Applications that share a single DBMS may also create risk to one another. Access controls defined for one application by default may provide access to the other application's database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.

Description

In the same way that added security layers can provide a cumulative positive effect on security posture, multiple applications can provide a cumulative negative effect. A vulnerability and subsequent exploit to one application can lead to an exploit of other applications sharing the same security context. For example, an exploit to a web server process that leads to unauthorized administrative access to the host system can most likely lead to a compromise of all applications hosted by the same system. A DBMS not installed on a dedicated host may pose a threat to and be threatened by other hosted applications. Applications that share a single DBMS may also create risk to one another. Access controls defined for one application by default may provide access to the other application's database objects or directories. Any method that provides any level of separation of security context assists in the protection between applications.

STIG	Date
Microsoft SQL Server 2005 Instance Security Technical Implementation Guide	2015-06-16

Details

Check Text ( C-20423r1_chk )
Review the list of processes/services running on the DBMS host system. For Windows, review the Services snap-in. Investigate with the DBA/SA any unknown services. If any of the services or processes are identified as supporting applications or functions not authorized in the System Security Plan, this is a Finding. Note: Only applications that are operationally required to share the same host system may be authorized to do so. Applications that share the same host for administrative, financial or other non-operational reasons may not be authorized and are a Finding.

Check Text ( C-20423r1_chk )

Review the list of processes/services running on the DBMS host system.

For Windows, review the Services snap-in. Investigate with the DBA/SA any unknown services.

If any of the services or processes are identified as supporting applications or functions not authorized in the System Security Plan, this is a Finding.

Note: Only applications that are operationally required to share the same host system may be authorized to do so. Applications that share the same host for administrative, financial or other non-operational reasons may not be authorized and are a Finding.

Fix Text (F-24599r1_fix)
A dedicated host system in this case refers to an instance of the operating system at a minimum. The operating system may reside on a virtual host machine if supported by the DBMS vendor. Remove any unauthorized processes or services and install on a separate host system. Where separation is not supported, update the System Security Plan and provide the technical requirement for having the application share a host with the DBMS.

Fix Text (F-24599r1_fix)

A dedicated host system in this case refers to an instance of the operating system at a minimum.

The operating system may reside on a virtual host machine if supported by the DBMS vendor.

Remove any unauthorized processes or services and install on a separate host system.

Where separation is not supported, update the System Security Plan and provide the technical requirement for having the application share a host with the DBMS.