| V-67379 | Medium | The Database Master Key encryption password must meet DoD password complexity requirements. | Weak passwords may be easily guessed. When passwords are used to encrypt keys used for encryption of sensitive data, then the confidentiality of all data encrypted using that key is at risk. |
| V-67373 | Medium | In a database owned by a login not having administrative privileges at the instance level, the database property TRUSTWORTHY must be OFF unless required and authorized. | SQL Server's fixed (built-in) server roles, especially [sysadmin], have powerful capabilities that could cause great harm if misused, so their use must be tightly controlled.
The SQL Server... |
| V-67371 | Medium | Database objects (including but not limited to tables, indexes, storage, stored procedures, functions, triggers, links to software external to SQL Server, etc.) must be owned by database/DBMS principals authorized for ownership. | Within the database, object ownership implies full privileges to the owned object, including the privilege to assign access to the owned objects to other subjects. Database functions and... |
| V-67377 | Medium | In the event of a system failure, SQL Server must preserve any information necessary to return to operations with least disruption to mission processes. | Discretionary Access Control (DAC) is based on the notion that individual users are "owners" of objects and therefore have discretion over who should be authorized to access the object and in... |
| V-67375 | Medium | In a database owned by [sa], or by any other login having administrative privileges at the instance level, the database property TRUSTWORTHY must be OFF. | SQL Server's fixed (built-in) server roles, especially [sysadmin], have powerful capabilities that could cause great harm if misused, so their use must be tightly controlled.
The SQL Server... |
| V-67427 | Medium | Trace or Audit records must be generated when unsuccessful attempts to delete categorized information (e.g., classification levels/security levels) occur. | Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected.
To aid in diagnosis, it is necessary to keep track of failed... |
| V-67385 | Medium | Symmetric keys must use a DoD certificate to encrypt the key. | Data within the database is protected by use of encryption. The symmetric keys are critical for this process. If the symmetric keys were to be compromised the data could be disclosed to... |
| V-67383 | Medium | Database Master Key passwords must not be stored in credentials within the database. | Storage of the Database Master Key password in a database credential allows decryption of sensitive data by privileged users who may not have a need-to-know requirement to access the data. |
| V-67381 | Medium | The Database Master Key must be encrypted by the Service Master Key, where a Database Master Key is required and another encryption method has not been specified. | When not encrypted by the Service Master Key, system administrators or application administrators may access and use the Database Master Key to view sensitive data that they are not authorized to... |
| V-67425 | Medium | SQL Server must generate Trace or Audit records when successful accesses to designated objects occur. | Without tracking all or selected types of access to all or selected objects (tables, views, procedures, functions, etc.), it would be difficult to establish, correlate, and investigate the events... |
| V-67389 | Medium | Database contents must be protected from unauthorized and unintended information transfer by enforcement of a data-transfer policy. | The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on... |
| V-67395 | Medium | The DBMS and associated applications, when making use of dynamic code execution, must scan input data for invalid values that may indicate a code injection attack. | With respect to database management systems, one class of threat is known as SQL Injection, or more generally, code injection. It takes advantage of the dynamic execution capabilities of various... |
| V-67435 | Medium | SQL Server must generate Trace or Audit records when unsuccessful attempts to modify locally-defined security objects occur. | SQL Server protects its built-in security objects (tables, views, functions, procedures, etc.) from alteration by database users and administrators. However, applications sometimes have... |
| V-67437 | Medium | Trace or Audit records must be generated when categorized information (e.g., classification levels/security levels) is created. | Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected.
For detailed information on categorizing information, refer... |
| V-67431 | Medium | SQL Server must generate Trace or Audit records when unsuccessful attempts to drop locally-defined security objects occur. | SQL Server protects its built-in security objects (tables, views, functions, procedures, etc.) from alteration by database users and administrators. However, applications sometimes have... |
| V-67419 | Medium | SQL Server must generate Trace or Audit records when unsuccessful attempts to modify privileges/permissions via locally-defined security objects occur. | Failed attempts to change the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized attempts to elevate or restrict privileges could... |
| V-67417 | Medium | SQL Server must generate Trace or Audit records when privileges/permissions are modified via locally-defined security objects. | Changes in the permissions, privileges, and roles granted to users and roles must be tracked. Without an audit trail, unauthorized elevation or restriction of privileges could go undetected.... |
| V-67415 | Medium | Trace or Audit records must be generated when unsuccessful attempts to access categorized information (e.g., classification levels/security levels) occur. | Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected.
To aid in diagnosis, it is necessary to keep track of failed... |
| V-67413 | Medium | Trace or Audit records must be generated when categorized information (e.g., classification levels/security levels) is accessed. | Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected.
For detailed information on categorizing information, refer... |
| V-67411 | Medium | When invalid inputs are received, SQL Server must behave in a predictable and documented manner that reflects organizational and system objectives. | A common vulnerability is unplanned behavior when invalid inputs are received. This requirement guards against adverse or unintended system behavior caused by invalid inputs, where information... |
| V-67369 | Medium | SQL Server must be monitored to discover unauthorized changes to stored procedures. | When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of SQL Server and/or application can potentially have significant... |
| V-67407 | Medium | Time stamps in database tables, intended for auditing or activity-tracking purposes, must include both date and time of day, with a minimum granularity of one second. | If time stamps are not consistently applied and there is no common time reference, it is difficult to perform forensic analysis, in audit files, trace files/tables, and application data... |
| V-67387 | Medium | The Service Master Key must be backed up, stored offline and off-site. | Backup and recovery of the Service Master Key may be critical to the complete recovery of the database. Not having this key can lead to loss of data during recovery. |
| V-67361 | Medium | Where SQL Server Audit is in use at the database level, SQL Server must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited at the database level. | Without the capability to restrict which roles and individuals can select which events are audited, unauthorized personnel may be able to prevent or interfere with the auditing of critical... |
| V-67405 | Medium | When supporting applications that require security labeling of data, SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in transmission. | Without the association of security labels to information, there is no basis for the DBMS to make security-related access-control decisions.
Security labels are abstractions representing the... |
| V-67433 | Medium | SQL Server must generate Trace or Audit records when locally-defined security objects are dropped. | SQL Server protects its built-in security objects (tables, views, functions, procedures, etc.) from alteration by database users and administrators. However, applications sometimes have... |
| V-67365 | Medium | SQL Server must be monitored to discover unauthorized changes to functions. | When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of SQL Server and/or application can potentially have significant... |
| V-67367 | Medium | SQL Server must be monitored to discover unauthorized changes to triggers. | When dealing with change control issues, it should be noted, any changes to the hardware, software, and/or firmware components of SQL Server and/or application can potentially have significant... |
| V-67391 | Medium | SQL Server must check the validity of all data inputs except those specifically identified by the organization. | Invalid user input occurs when a user inserts data or characters into an application’s data entry fields and the application is unprepared to process that data. This results in unanticipated... |
| V-67357 | Medium | SQL Server must enforce approved authorizations for logical access to information and database-level system resources in accordance with applicable access control policies. | Authentication with a DoD-approved PKI certificate does not necessarily imply authorization to access the database and all its contents. To mitigate the risk of unauthorized access to sensitive... |
| V-67441 | Medium | Trace or Audit records must be generated when categorized information (e.g., classification levels/security levels) is modified. | Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected.
For detailed information on categorizing information, refer... |
| V-67443 | Medium | Trace or Audit records must be generated when unsuccessful attempts to modify categorized information (e.g., classification levels/security levels) occur. | Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected.
For detailed information on categorizing information, refer... |
| V-67399 | Medium | SQL Server must reveal detailed error messages only to the ISSO, ISSM (or their designees), SA and DBA. | If the DBMS provides too much information in error logs and administrative messages to the screen, this could lead to compromise. The structure and content of error messages need to be carefully... |
| V-67439 | Medium | Trace or Audit records must be generated when unsuccessful attempts to create categorized information (e.g., classification levels/security levels) occur. | Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected.
To aid in diagnosis, it is necessary to keep track of failed... |
| V-67401 | Medium | When supporting applications that require security labeling of data, SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in storage. | Without the association of security labels to information, there is no basis for the DBMS to make security-related access-control decisions.
Security labels are abstractions representing the... |
| V-67403 | Medium | When supporting applications that require security labeling of data, SQL Server must associate organization-defined types of security labels having organization-defined security label values with information in process. | Without the association of security labels to information, there is no basis for the DBMS to make security-related access-control decisions.
Security labels are abstractions representing the... |
| V-67423 | Medium | SQL Server must generate Trace or Audit records when unsuccessful accesses to designated objects occur. | Without tracking all or selected types of access to all or selected objects (tables, views, procedures, functions, etc.), it would be difficult to establish, correlate, and investigate the events... |
| V-67397 | Medium | The DBMS and associated applications must provide non-privileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries. | Any DBMS or associated application providing too much information in error messages on the screen or printout risks compromising the data and security of the system. The structure and content of... |
| V-67421 | Medium | SQL Server must generate Trace or Audit records when locally-defined security objects are modified. | SQL Server protects its built-in security objects (tables, views, functions, procedures, etc.) from alteration by database users and administrators. However, applications sometimes have... |
| V-67409 | Medium | SQL Server must implement and/or support cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest (to include, at a minimum, PII and classified information) on organization-defined information system components. | Databases holding data requiring "data at rest" protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. These cryptographic... |
| V-67393 | Medium | The DBMS and associated applications must reserve the use of dynamic code execution for situations that require it. | With respect to database management systems, one class of threat is known as SQL Injection, or more generally, code injection. It takes advantage of the dynamic execution capabilities of various... |
| V-67359 | Medium | SQL Server must generate Trace or Audit records for organization-defined auditable events. | Audit records can be generated from various components within the information system (e.g., network interface, hard disk, modem, etc.). From an application perspective, certain specific... |
| V-67429 | Medium | Trace or Audit records must be generated when categorized information (e.g., classification levels/security levels) is deleted. | Changes in categorized information must be tracked. Without an audit trail, unauthorized access to protected data could go undetected.
For detailed information on categorizing information, refer... |
