SQL Server must prevent unauthorized and unintended information transfer via shared system resources.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-79211	SQL6-D0-009800	SV-93917r1_rule		Medium

Description
The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.

Description

The purpose of this control is to prevent information, including encrypted representations of information, produced by the actions of a prior user/role (or the actions of a process acting on behalf of a prior user/role) from being available to any current user/role (or current process) that obtains access to a shared system resource (e.g., registers, main memory, secondary storage) after the resource has been released back to the information system. Control of information in shared resources is also referred to as object reuse.

STIG	Date
MS SQL Server 2016 Instance Security Technical Implementation Guide	2018-03-09

Details

Check Text ( C-78803r1_chk )
Review system documentation to determine if Common Criteria Compliance is not required due to potential impact on system performance. SQL Server Residual Information Protection (RIP) requires a memory allocation to be overwritten with a known pattern of bits before memory is reallocated to a new resource. Meeting the RIP standard can contribute to improved security; however, overwriting the memory allocation can slow performance. After the common criteria compliance enabled option is enabled, the overwriting occurs. Review the Instance configuration: SELECT name, value_in_use FROM sys.configurations WHERE name = 'common criteria compliance enabled' and value_in_use = 0 If no records are returned and an exception is not defined in the system documentation, this is a finding. NOTE: Enabling this feature may impact performance on highly active SQL Server instances. If enabling this feature impacts performance, this setting may be disabled and the category reduced to a CAT III finding.

Check Text ( C-78803r1_chk )

Review system documentation to determine if Common Criteria Compliance is not required due to potential impact on system performance.

SQL Server Residual Information Protection (RIP) requires a memory allocation to be overwritten with a known pattern of bits before memory is reallocated to a new resource. Meeting the RIP standard can contribute to improved security; however, overwriting the memory allocation can slow performance. After the common criteria compliance enabled option is enabled, the overwriting occurs.

Review the Instance configuration:

SELECT name, value_in_use FROM sys.configurations
WHERE name = 'common criteria compliance enabled'
and value_in_use = 0

If no records are returned and an exception is not defined in the system documentation, this is a finding.

NOTE: Enabling this feature may impact performance on highly active SQL Server instances. If enabling this feature impacts performance, this setting may be disabled and the category reduced to a CAT III finding.

Fix Text (F-85963r1_fix)
Configure SQL Server to effectively protect the private resources of one process or user from unauthorized access by another user or process. sp_configure 'show advanced options', 1; GO RECONFIGURE; GO sp_configure 'common criteria compliance enabled', 1; GO RECONFIGURE GO