Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
Database Master Key passwords must not be stored in credentials within the database.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-41416 | SQL2-00-024200 | SV-53945r2_rule | Medium |
| Description |
|---|
| Storage of the Database Master Key password in a database credential allows decryption of sensitive data by privileged users who may not have a need-to-know requirement to access the data. |
| STIG | Date |
|---|---|
| Microsoft SQL Server 2012 Database Instance Security Technical Implementation Guide | 2019-01-08 |
Details
| Check Text ( C-47952r1_chk ) |
|---|
| From the query prompt: SELECT COUNT(credential_id) FROM [master].sys.master_key_passwords If count is not 0, this is a finding. |
| Fix Text (F-46845r2_fix) |
|---|
| Use the stored procedure sp_control_dbmasterkey_password to remove any credentials that store Database Master Key passwords. From the query prompt: EXEC SP_CONTROL_DBMASTERKEY_PASSWORD @db_name = '[database name]', @action = N'drop' |