The DBMS should not share a host supporting an independent security service.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-15179	DG0110-SQLServer9	SV-24283r1_rule	DCSP-1	Medium

Description
The Security Support Structure is a security control function or service provided by an external system or application. An example of this would be a Windows domain controller that provides identification and authentication that can be used by other systems to control access. The vulnerabilities and, therefore, associated risk of a DBMS installed on a system that provides a security support structure is significantly higher than when installed with other functions that do not provide security support. In cases where the DBMS is dedicated to local support of a security support function (e.g. a directory service), separation may not be possible.

Description

The Security Support Structure is a security control function or service provided by an external system or application. An example of this would be a Windows domain controller that provides identification and authentication that can be used by other systems to control access. The vulnerabilities and, therefore, associated risk of a DBMS installed on a system that provides a security support structure is significantly higher than when installed with other functions that do not provide security support. In cases where the DBMS is dedicated to local support of a security support function (e.g. a directory service), separation may not be possible.

STIG	Date
Microsoft SQL Server 2005 Instance Security Technical Implementation Guide	2015-06-16

Details

Check Text ( C-28584r1_chk )
Review the services and processes active on the DBMS host system. If the host system is acting as a Windows domain controller, this is a finding. If the host system is supporting any other directory or security service that does not use the DBMS to store the directory information, this is a Finding. Note: A local installation of Anti-virus or Firewall does not constitute a security service in this context.

Check Text ( C-28584r1_chk )

Review the services and processes active on the DBMS host system.

If the host system is acting as a Windows domain controller, this is a finding.

If the host system is supporting any other directory or security service that does not use the DBMS to store the directory information, this is a Finding.

Note: A local installation of Anti-virus or Firewall does not constitute a security service in this context.

Fix Text (F-20270r1_fix)
Either move the DBMS installation to a dedicated host system or move the directory or security services to another host system. A dedicated host system in this case refers to an instance of the operating system at a minimum. The operating system may reside on a virtual host machine if supported by the DBMS vendor.