UCF STIG Viewer Logo

Application objects should be owned by accounts authorized for ownership.


Overview

Finding ID Version Rule ID IA Controls Severity
V-15607 DG0008-SQLServer9 SV-24068r2_rule ECLP-1 Medium
Description
Database object ownership implies full privileges to the owned object including the privilege to assign access to the owned objects to other subjects. Unmanaged or uncontrolled ownership of objects can lead to unauthorized object grants and alterations.
STIG Date
Microsoft SQL Server 2005 Database Security Technical Implementation Guide 2015-06-16

Details

Check Text ( C-23671r2_chk )
From the query prompt:

SELECT name AS [Database Name]
FROM [master].sys.databases
WHERE state = 0

Repeat for each database:

From the query prompt:

USE [Database Name]
SELECT DISTINCT s.name AS [Schema Name], u.name AS [Principal], u.type_desc AS [Type]
FROM sys.schemas s
JOIN sys.database_principals u ON s.principal_id = u.principal_id
JOIN sys.all_objects o ON s.schema_id = o.schema_id
WHERE u.name NOT IN ('dbo', 'INFORMATION_SCHEMA', 'sys')
ORDER BY s.name, u.name

Review the object ownerships listed. Verify any listed accounts are authorized application installation accounts and documented in the System Security Plan.

If any accounts are not authorized, this is a Finding.

If any authorized accounts listed are not documented in the System Security Plan, this is a Finding.
Fix Text (F-17828r1_fix)
Create database accounts dedicated for application object ownership.

To simplify access authorizations, use a single account for each application to avoid cross chaining of ownership, which makes security configuration more complex and degrades system performance.

Document all application object ownership in the System Security Plan and authorize with the IAO.