Title: Database software, applications and configuration files must be monitored to discover unauthorized changes.
Vulnerability ID: V-32415
IA Controls: None
Description: When dealing with change control issues, it should be noted any changes to the hardware, software, and/or firmware components of the information system and/or application can potentially have significant effects on the overall security of the system.
If the application were to allow any user to make changes to software libraries, then those changes might be implemented without undergoing the appropriate testing and approvals that are part of a robust change management process.
This requirement is contingent upon the language in which the application is programmed, as many application architectures in use today incorporate their software libraries into and make them inseparable from their compiled distributions rendering them static and version dependant. However, this requirement does apply to applications with software libraries accessible and configurable as in the case of interpreted languages.
Accordingly, only qualified and authorized individuals shall be allowed to obtain access to information system components for purposes of initiating changes, including upgrades and modifications.
Unmanaged changes that occur to the database software libraries or configuration can lead to unauthorized or compromised installations.
Check Text: Review monitoring procedures and implementation evidence to verify monitoring of changes to database software libraries, related applications and configuration files is done. Verify the list of files, directories, and database application objects (procedures, functions, and triggers) being monitored is complete. If monitoring does not occur or is not complete, this is a finding.
Fix Text: Implement procedures to monitor for unauthorized changes to DBMS software libraries, related software application libraries and configuration files. If a third-party automated tool is not employed, an automated job that reports file information on the directories and files of interest and compares them to the baseline report for the same will meet the requirement.
File hashes or checksums should be used for comparisons as file dates may be manipulated by malicious users.
Here we are stepping outside the realm of the DBA again. This STIG deals with the monitoring of system and application source files. There really isn’t much that can be done within SQL Server to check for these so an external app or process will need to be in place. One could create a job and use the SQL Agent to schedule it to run and check file information in the directories used for SQL Server, but it may be easier and more secure to use either a centralized server or process to perform the action. I suggest this since malicious code changes could result in the SQL Agent not operating correctly and thus taking down the monitoring solution you may have implemented.