Title: The DBMS must maintain reviewer/releaser identity and credentials within the established chain of custody for all information reviewed or released.
Vulnerability ID: V-32351
IA Controls: None
Description: Non-repudiation protects individuals against later claims by an author of not having authored a particular document, a sender of not having transmitted a message, a receiver of not having received a message, or a signatory of not having signed a document. Non-repudiation services can be used to determine if information originated from an individual, or if an individual took specific actions (e.g., sending an email, signing a contract, approving a procurement request) or received specific information. Non-repudiation services are obtained by employing various techniques or mechanisms (e.g., digital signatures, digital message receipts).
When it comes to data review and data release, there must be a correlation between the data that is reviewed and the person who performs the review. If the reviewer is a human or if the review function is automated but separate from the release/transfer function, the application associates the identity of the reviewer of the information to be released with the information and the information label.
In the case of human reviews, this requirement provides appropriate organizational officials the means to identify who reviewed and released the information. In the case of automated reviews, this control enhancement helps ensure only approved review functions are employed.
If the database does not maintain reviewer/releaser identity and credentials within the established chain of custody for all information reviewed or released, information may be released without being reviewed or releaser information may be lost and accountability for the release of the information may be compromised.
Check Text: Review system documentation to determine whether reviewer/releaser and credentials are required for information stored and released from the database. If reviewer/releaser and credentials are not required, this is NA.
Review DBMS configuration to verify reviewer/releaser identity and credentials are maintained when information is reviewed or released. If reviewer/releaser information is not maintained, this is a finding.
Fix Text: Configure the DBMS to maintain reviewer/releaser identity and credentials for all information reviewed or released.[divider]
Non-repudiation is handled in SQL Server by using the integrated SQL Server Audit feature. This feature is available in both standard and enterprise edition, though it is highly restricted int he details it can collect in Standard Edition. There is no wizard to configure SQL Server Audit, but it is pretty straight forward. In the case here you would need to setup the Audit to capture the user executing various actions in your environment.