MS SQL Server 2016 Instance STIG Version Comparison

There are 2 differences between versions v3 r2 (Oct. 24, 2024) (the "left" version) and v3 r4 (April 2, 2025) (the "right" version).

Check SQL6-D0-008200 was changed between these two versions. Green, underlined text was added, red, struck-out text was removed.

The regular view of the left check and right check may be easier to read.

Title

If passwords are used for authentication, SQL Server must transmit only encrypted representations of passwords.

Check Content

If you are using 1. Launch SSMS and connect to the SQL Server to be reviewed. 2. Right-click the instance and select "Properties". 3. Navigate to the "Security" tab. If the value for "Server authentication" is "Windows Authentication mode" mode", this requirement is can be marked as Not Applicable. From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", "sqlservermanager13.msc" and pressing "Enter". Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on "Protocols", where there is a placeholder for the SQL Server instance name, and click on “Properties”. On "Properties". On the "Flags" tab, if "Force Encryption" is set to “NO", this is a finding. On the "Flags" tab, if "Force Encryption" is set to "YES", examine the certificate used on the "Certificate" tab. If it is not a DOD approved certificate, or if no certificate is listed, this is a finding. For clustered instances, the Certificate will NOT be shown in the SQL Server Configuration Manager. 1. From a command prompt prompt, navigate to the certificate store where the Full Qualified Domain Name (FQDN) certificate is stored, stored by typing "certlm.msc", "certlm.msc" and pressing "Enter". 2. In the left side of the window, expand the "Personal" folder, and click "Certificates". 3. Verify that the Certificate with the FQDN name is issued by the DOD. Double-click Double click the certificate, click the "Details" tab tab, and note the value for the Thumbprint. 4. The Verify the value for the "Thumbprint" field should match matches the value in the registry by running regedit and look looking at "HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>\MSSQLServer\SuperSocketNetLib\Certificate". 5. Run this on each node of the cluster. If any nodes have a certificate in use by SQL that is not issued or approved by DOD, this is a finding.

Discussion

The DoD DOD standard for authentication is DoD-approved DOD-approved PKI certificates. Authentication based on User ID and Password may be used only when it is not possible to employ a PKI certificate, certificate and requires AO approval. In such cases, passwords need to be protected at all times, and encryption is the standard method for protecting passwords during transmission. SQL Server passwords sent in clear text format across the network are vulnerable to discovery by unauthorized users. Disclosure of passwords may easily lead to unauthorized access to the database.

Fix

Configure SQL Server to encrypt authentication data for remote connections using DoD-approved DOD-approved cryptography. Deploy encryption to the SQL Server Network Connections. From a command prompt, open SQL Server Configuration Manager by typing "sqlservermanager13.msc", "sqlservermanager13.msc" and pressing "ENTER". Navigate to SQL Server Configuration Manager >> SQL Server Network Configuration. Right-click on Protocols for, where is a placeholder for the SQL Server instance name, and click on "Properties". In the "Protocols for Properties" dialog box, on the "Certificate" tab, select the DOD certificate from the drop-down drop down for the Certificate box, box and then click "OK". On the "Flags" tab, in the "ForceEncryption" box, select "Yes", "Yes" and then click "OK" to close the dialog box. Then Restart the SQL Server service. For clustered instances instances, install the certificate after setting "Force Encryption" to "Yes" in SQL Server Configuration Manger. 1. Manager. 1. Navigate to the certificate store where the FQDN certificate is stored, stored by typing "certlm.msc" and pressing "ENTER". 2. On the "Properties" page for the certificate, go to the "Details" tab and copy the "thumbprint" value of the certificate to a "Notepad" window. 3. Remove the spaces between the hex characters in the "thumbprint" value in Notepad. 4. Start regedit, navigate to the following registry key, and copy the value from step 2: HKLM\SOFTWARE\Microsoft\Microsoft SQL Server\<instance>\MSSQLServer\SuperSocketNetLib\Certificate 5. If the SQL virtual server is currently on this node, failover to another node in your the cluster, cluster and then reboot the node where the registry change occurred. 6. Repeat this procedure on all the nodes.