Title: The application must either implement compensating security controls or the organization explicitly accepts the risk of not performing the verification as required.
Vulnerability ID: V-32594
STIG ID: SRG-APP-000289-DB-NA
IA Controls: none
Description: Application security functional testing involves testing the application for conformance to the applications security function specifications, as well as, for the underlying security model. The need to verify security functionality applies to all security functions. The conformance criteria state the conditions necessary for the application to exhibit the desired security behavior or satisfy a security property for example, successful login triggers an audit entry. Organizations may define conditions requiring verification and the frequency in which such testing occurs. Security function testing usually occurs during the development phase and can in some instances occur in the production phase if the developer provides the security conformance criteria or if the conformance criteria can be established. There are application testing frameworks available that can perform functional testing on production systems however they are limited in their applicability and are language or product centric. This requirement is specific to applications providing automated testing functionality. This requirement is NA for databases.
Check Text: This check is NA for databases.
Fix Text: This fix is NA for databases.[divider]
This STIG is fairly open ended. It does apply only to DBMS systems that provide automated testing functionality, which SQl Server really doesn’t have (but you can make your own jobs and scripts to do so if you really wanted). If you have any sort of automated testing setup in your SQL Server environment it basically boils down to 1) You define functional testing to verify your SQL Server auditing is working as expected, or 2) You ignore it and assume it’ll be all right when needed.