Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.
Assessment Title
Rule Text
SQL Server must ensure users are authenticated with an individual authenticator prior to using a shared authenticator.
Description
Discussion Text
To ensure individual accountability and prevent unauthorized access, application users (and any processes acting on behalf of users) must be individually identified and authenticated.
A shared authenticator is a generic account used by multiple individuals. Use of a shared authenticator alone does not uniquely identify individual users. An example of a shared authenticator is the UNIX OS 'root' user account, a Windows 'administrator' account, an 'sa' account, or a 'helpdesk' account.
Legitimate use of shared accounts includes, for example, connection pooling. Since this is insufficient to ensure non-repudiation, such shared accounts should be kept "under the covers," be inaccessible directly to end users, be invoked only after successful individual authentication, be communicated to the DBMS by the application, and be recorded in all relevant audit contexts.
(Shared accounts should not be confused with Windows groups, which are used in role-based access control.)
A shared authenticator is a generic account used by multiple individuals. Use of a shared authenticator alone does not uniquely identify individual users. An example of a shared authenticator is the UNIX OS 'root' user account, a Windows 'administrator' account, an 'sa' account, or a 'helpdesk' account.
Legitimate use of shared accounts includes, for example, connection pooling. Since this is insufficient to ensure non-repudiation, such shared accounts should be kept "under the covers," be inaccessible directly to end users, be invoked only after successful individual authentication, be communicated to the DBMS by the application, and be recorded in all relevant audit contexts.
(Shared accounts should not be confused with Windows groups, which are used in role-based access control.)
New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.