SQL Server must protect against an individual using a group account from falsely denying having performed a particular action.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-41034	SQL2-00-023700	SV-53409r1_rule		Low

Description
Non-repudiation of actions taken is required in order to maintain application integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. Non-repudiation protects individuals against later claims by an author of not having authored a particular document, a sender of not having transmitted a message, a receiver of not having received a message, or a signatory of not having signed a document. SQL Server group authentication does not provide individual accountability for actions taken on the DBMS or data. Whenever a single database account is used to connect to the database, a secondary authentication method that provides individual accountability is required. This scenario most frequently occurs when an externally hosted application authenticates individual users to the application and the application uses a single account to retrieve or update database information on behalf of the individual users. When group accounts are utilized without another means of identifying individual users, users may deny having performed a particular action.

Description

Non-repudiation of actions taken is required in order to maintain application integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. Non-repudiation protects individuals against later claims by an author of not having authored a particular document, a sender of not having transmitted a message, a receiver of not having received a message, or a signatory of not having signed a document. SQL Server group authentication does not provide individual accountability for actions taken on the DBMS or data. Whenever a single database account is used to connect to the database, a secondary authentication method that provides individual accountability is required. This scenario most frequently occurs when an externally hosted application authenticates individual users to the application and the application uses a single account to retrieve or update database information on behalf of the individual users. When group accounts are utilized without another means of identifying individual users, users may deny having performed a particular action.

STIG	Date
Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide	2014-06-23

Details

Check Text ( C-47651r2_chk )
Obtain the list of authorized SQL Server accounts in the system documentation. Get the list of SQL Server user accounts that are in SQL Server by executing: Select * from sys.server_principals If any accounts indicate use by multiple persons that are not mapped to a specific person in the system documentation, this is a finding. (The key is individual accountability. If this can be traced, this is not a finding.) If any applications or processes share an account that could be assigned to an individual account or are not specified as requiring a shared account, this is a finding. Note: Privileged installation accounts may be required to be accessed by the DBA or other administrators for system maintenance. In these cases, each use of the account must be logged in some manner to assign accountability for any actions taken during the use of the account.

Check Text ( C-47651r2_chk )

Obtain the list of authorized SQL Server accounts in the system documentation.

Get the list of SQL Server user accounts that are in SQL Server by executing:

Select * from sys.server_principals

If any accounts indicate use by multiple persons that are not mapped to a specific person in the system documentation, this is a finding. (The key is individual accountability. If this can be traced, this is not a finding.)

If any applications or processes share an account that could be assigned to an individual account or are not specified as requiring a shared account, this is a finding.

Note: Privileged installation accounts may be required to be accessed by the DBA or other administrators for system maintenance. In these cases, each use of the account must be logged in some manner to assign accountability for any actions taken during the use of the account.

Fix Text (F-46333r2_fix)
Use organizational methods for creating individual accounts for each user, application, or other process that requires a database connection. Document any accounts that are shared where separation is not supported by the application or for maintenance support. Design, develop, and implement a method to log use of any account to which more than one person has access. Restrict interactive access to shared accounts to the fewest persons possible.

Fix Text (F-46333r2_fix)

Use organizational methods for creating individual accounts for each user, application, or other process that requires a database connection.

Document any accounts that are shared where separation is not supported by the application or for maintenance support.

Design, develop, and implement a method to log use of any account to which more than one person has access. Restrict interactive access to shared accounts to the fewest persons possible.