Title: The DBMS must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission unless the transmitted data is otherwise protected by alternative physical measures.
Vulnerability ID: V-32568
STIG ID: SRG-APP-000264-DB-000136
IA Controls: None
Description: Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during transmission. This is usually achieved through the use of Transport Layer Security (TLS), SSL VPN, or IPSEC tunnel. Alternative physical protection measures include Protected Distribution Systems (PDS). PDS are used to transmit unencrypted classified NSI through an area of lesser classification or control. In as much as the classified NSI is unencrypted, the PDS must provide adequate electrical, electromagnetic, and physical safeguards to deter exploitation. Refer to NSTSSI No. 7003 for additional details on a PDS. Information in transmission is particularly vulnerable to attack. If the DBMS does not employ cryptographic mechanisms preventing unauthorized disclosure of information during transit, the information may be compromised.
Check Text: Check DBMS settings to determine whether cryptographic mechanisms are used to prevent the unauthorized disclosure of information during transmission. Determine whether physical measures are being used instead of cryptographic mechanisms. If neither cryptographic nor physical measures are being utilized, this is a finding.
Fix Text: Configure DBMS to use cryptographic mechanisms to prevent unauthorized disclosure of information during transmission where physical measures are not being utilized[divider]
It is very easy to grab simple tools online that can capture and sniff the packets being sent between your SQL Server and client systems. SQL Server attempts to encrypt the UID and password when transmitted. Unless you configure SQL Server specifically to encrypt the transmissions everything is sent in relatively plain text.
With respect to SQL Server you can configure the use of SSL certificates to encrypt the communication between the server instance and any clients. This can be done at a very base level using a self-signed SSL certificate generated in IIS on the server. The preferred method would be to get a certificate from a trusted source. More information can be found here: