SQL Server databases in the unclassified environment, containing sensitive information, must be encrypted using approved cryptography.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-53877	SQL2-00-019601	SV-68097r2_rule		Medium

Description
Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Data files that are not encrypted are vulnerable to theft. When data files are not encrypted, they can be copied and opened on a separate system. The data can be compromised without the information owner's knowledge that the theft has even taken place.

Description

Cryptography is only as strong as the encryption modules/algorithms employed to encrypt the data. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to protect data. Data files that are not encrypted are vulnerable to theft. When data files are not encrypted, they can be copied and opened on a separate system. The data can be compromised without the information owner's knowledge that the theft has even taken place.

STIG	Date
Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide	2018-02-27

Details

Check Text ( C-54717r1_chk )
If the system exists in the Classified environment, this is NA. For each database under the SQL Server instance, review the system documentation to determine whether the database holds sensitive information. If it does not, this is not a finding. If it does handle sensitive information, review the system documentation and configuration to determine whether the sensitive information is protected by NIST-approved cryptography. If not, this is a finding.

Check Text ( C-54717r1_chk )

If the system exists in the Classified environment, this is NA.

For each database under the SQL Server instance, review the system documentation to determine whether the database holds sensitive information. If it does not, this is not a finding.

If it does handle sensitive information, review the system documentation and configuration to determine whether the sensitive information is protected by NIST-approved cryptography. If not, this is a finding.

Fix Text (F-58707r1_fix)
Configure SQL Server to encrypt sensitive data stored in each database. Use only NIST-certified cryptography to provide encryption.