Title: The application uses cryptographic mechanisms to protect the integrity of audit tools.
Vulnerability ID: V-32595
IA Controls: None
Description: Protecting the integrity of the tools used for auditing purposes is a critical step to ensuring the integrity of audit data. Audit data includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.
It is not uncommon for attackers to replace the audit tools or inject code into the existing tools with the purpose of providing the capability to hide or erase system activity from the audit logs.
To address this risk, audit tools must be cryptographically signed in order to provide the capability to identify when the audit tools have been modified, manipulated or replaced. An example is a checksum hash of the file or files.
Applications that function as audit tools must use cryptographic mechanisms to protect the integrity of the tools or allow cryptographic protection mechanisms to be applied to their tools. All applications must not impede or hamper this requirement.
This requirement is specific to applications that function as audit tools. This is NA for databases.
Check Text: This check is NA for databases.
Fix Text: This fix is NA for databases.[divider]
As noted above, this doesn’t apply directly to databases, but to the tools that are used to audit databases and activity against them.
There are some Audit tools included/embedded within SQL Server, so we don’t feel this should be glossed over if these are the only tools being used.
We are digging in more to determine if there are appropriate measures taken to protect the auditing tools within SQL Server itself and will update this entry once we learn more.