SQL Servers data files containing sensitive information must be encrypted.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-40917	SQL2-00-019600	SV-53271r1_rule		High

Description
Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Data files that are not encrypted are vulnerable to theft. When data files are not encrypted they can be copied and opened on a separate system. The data can be compromised without the information owner's knowledge that the theft has even taken place.

Description

Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Data files that are not encrypted are vulnerable to theft. When data files are not encrypted they can be copied and opened on a separate system. The data can be compromised without the information owner's knowledge that the theft has even taken place.

STIG	Date
Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide	2014-01-17

Details

Check Text ( C-47572r2_chk )
Review the system documentation to determine whether the database handles classified information. If no classified information is contained in SQL Server then the Category Code 2 is a finding. Review the system documentation to discover sensitive or classified data identified by the Information Owner that requires encryption. Have the DBA use select statements in the database to review sensitive data stored in tables as identified in the system documentation. Note: All encrypted data should be human unreadable by unauthorized users. If any data identified as sensitive is not encrypted within any database, this is a finding.

Check Text ( C-47572r2_chk )

Review the system documentation to determine whether the database handles classified information. If no classified information is contained in SQL Server then the Category Code 2 is a finding.

Review the system documentation to discover sensitive or classified data identified by the Information Owner that requires encryption.

Have the DBA use select statements in the database to review sensitive data stored in tables as identified in the system documentation. Note: All encrypted data should be human unreadable by unauthorized users.

If any data identified as sensitive is not encrypted within any database, this is a finding.

Fix Text (F-46199r1_fix)
Configure SQL Server to encrypt sensitive or classified data stored in each database. Use only NIST-certified or NSA-approved cryptography to provide encryption.