Title

DBMS application user roles should not be assigned unauthorized privileges. (Cat II impact)

Discussion

Unauthorized access to the data can lead to loss of confidentiality and integrity of the data.

Check Content

Compare privileges assigned to database application user roles to those defined in the System Security Plan. From the query prompt: SELECT name FROM [master].sys.databases WHERE name NOT IN ('tempdb', 'ReportServerTempDB') AND state = 0 Repeat for each database: USE [database name] SELECT r.name, o.name, p.permission_name FROM sys.database_principals r, sys.database_permissions p, sys.all_objects o WHERE p.grantee_principal_id = r.principal_id AND p.major_id = o.object_id AND r.principal_id NOT IN (0, 2) AND r.type IN ('A', 'R') AND r.is_fixed_role = 0 ORDER BY r.name, o.name, p.permission_name If the assigned privileges do not match the authorized list of privileges, this is a Finding. Note: Default privileges assigned to fixed data roles are considered authorized by default.

Fix Text

Use the grant and revoke commands to assign the authorized privileges as listed in the System Security Plan to custom database application or application user roles.

Additional Identifiers

Rule ID: SV-24098r2_rule

Vulnerability ID: V-15128

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.