If passwords are used for authentication, SQL Server must transmit only encrypted representations of passwords.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-79195	SQL6-D0-008200	SV-93901r1_rule		High

Description
The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. In such cases, passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. SQL Server passwords sent in clear text format across the network are vulnerable to discovery by unauthorized users. Disclosure of passwords may easily lead to unauthorized access to the database.

Description

The DoD standard for authentication is DoD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, and requires AO approval. In such cases, passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. SQL Server passwords sent in clear text format across the network are vulnerable to discovery by unauthorized users. Disclosure of passwords may easily lead to unauthorized access to the database.

STIG	Date
MS SQL Server 2016 Instance Security Technical Implementation Guide	2018-03-09

Details

Check Text ( C-78787r1_chk )
From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", and pressing "ENTER". Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on Protocols for, where is a placeholder for the SQL Server instance name, and click on "Properties". On the "Flags" tab, if "Force Encryption" is set to "NO", this is a finding. On the "Flags" tab, if "Force Encryption" is set to "YES", examine the certificate used on the "Certificate" tab. If it is not a DoD certificate, or if no certificate is listed, this is a finding. A number of known vulnerabilities has been reported against SSL and earlier versions of TLS which has changed the security guidance to move to TLS 1.2 for support secure communication. Check to see if SSL is still in use instead of TLS 1.2, if so, this is a CAT II finding.

Check Text ( C-78787r1_chk )

From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", and pressing "ENTER".

Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on Protocols for, where is a placeholder for the SQL Server instance name, and click on "Properties".

On the "Flags" tab, if "Force Encryption" is set to "NO", this is a finding.

On the "Flags" tab, if "Force Encryption" is set to "YES", examine the certificate used on the "Certificate" tab.

If it is not a DoD certificate, or if no certificate is listed, this is a finding.

A number of known vulnerabilities has been reported against SSL and earlier versions of TLS which has changed the security guidance to move to TLS 1.2 for support secure communication. Check to see if SSL is still in use instead of TLS 1.2, if so, this is a CAT II finding.

Fix Text (F-85947r1_fix)
Configure SQL Server to encrypt authentication data for remote connections using DoD-approved cryptography. Deploy encryption to the SQL Server Network Connections. From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", and pressing "ENTER". Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on Protocols for, where is a placeholder for the SQL Server instance name, and click on "Properties". In the "Protocols for Properties" dialog box, on the "Certificate" tab, select the DOD certificate from the drop down for the Certificate box, and then click "OK". On the "Flags" tab, in the "ForceEncryption" box, select "Yes", and then click "OK" to close the dialog box. Then Restart the SQL Server service. In cases where SSL is being used instead of TLS 1.2, use the following guidance for switching to the more secure TLS 1.2. https://support.microsoft.com/en-us/kb/3135244

Fix Text (F-85947r1_fix)

Configure SQL Server to encrypt authentication data for remote connections using DoD-approved cryptography.

Deploy encryption to the SQL Server Network Connections.

From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", and pressing "ENTER".

Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on Protocols for, where is a placeholder for the SQL Server instance name, and click on "Properties".

In the "Protocols for Properties" dialog box, on the "Certificate" tab, select the DOD certificate from the drop down for the Certificate box, and then click "OK". On the "Flags" tab, in the "ForceEncryption" box, select "Yes", and then click "OK" to close the dialog box. Then Restart the SQL Server service.

In cases where SSL is being used instead of TLS 1.2, use the following guidance for switching to the more secure TLS 1.2.

https://support.microsoft.com/en-us/kb/3135244