Microsoft SQL Server Database 2012 Security Technical Implementation Guide

The Microsoft SQL Server Database 2012 Security Technical Implementation Guide (V1 R20) has 28 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

28STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R20

CurrentPublished Thu Jan 16 2020

Database Master Key passwords must not be stored in credentials within the database.

Microsoft SQL Server Database 2012 Security Technical Implementation Guide

Assessment Title

Rule Text

Database Master Key passwords must not be stored in credentials within the database.

Description

Discussion Text

Storage of the Database Master Key password in a database credential allows decryption of sensitive data by privileged users who may not have a need-to-know requirement to access the
data.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-41416

Rule

SV-53945r2_rule

Severity

medium

Rule Version

SQL2-00-024200

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

From the query prompt:
SELECT COUNT(credential_id)
FROM [master].sys.master_key_passwords

If count is not 0, this is a finding.

Implementation Procedure

Fix Text

Use the stored procedure sp_control_dbmasterkey_password to remove any credentials that
store Database Master Key passwords.
From the query prompt:
EXEC SP_CONTROL_DBMASTERKEY_PASSWORD @db_name = '[database name]', @action
= N'drop'

STIG check 20 of 28 in the Microsoft SQL Server Database 2012 STIG checklist

← Previous · V-41415The Database Master Key must be encrypted by the Service Master Key where required.Next · V-41417 →Symmetric keys (other than the database master key) must use a DoD certificate to encrypt the key.