Severity: CAT2
Description: Asymmetric keys derived from self-signed certificates or self-generated by other means do not meet the security requirements of DoD that require validation by DoD trusted certificate authorities.
Check:
From the query prompt:
For each database:
select name,suser_sname(sid) ‘User’ from sys.asymmetric_keys
If no keys are defined for any database, then this check is NA.
If keys are returned, verify the key is associated with a DoD PKI Certificate.
Evidence may include review of the certificate of a signed file used to read the key into the database.
If the key is not from a DoD PKI certificate or evidence cannot be determined or presented, then this is a Finding.
Fix:
Where asymmetric key use is required, the asymmetric should be generated using a code-signing certificate or using the database master key to encrypt the private key. Use of the asymmetric key is expected in DoD installations to be used to support symmetric keys that are in turn used to encrypt sensitive data.
In a DoD environement, asymemtric keys generated and stored within the SQL Server database are not expected to be used for storage of DoD PKI certificates associated with DoD personnel and used to authenticate them for any database access.
Create asymmetric key <key name>
or
create asymmetric key <key name> from <asymmetric key source>
<asymmetric key source may be FILE=<strong file name> or EXECUTABLE FILE=’executable file’ or ASSEMBLY <assembly name>
Each of the assymetric key sources are expected in a DoD environment to files signed with code-signing certificates issued by the DoD PKMO. Use of the database master key to encrypt is acceptable, especially where the key is generated using the service master key which in turn is generated from the server certificate. In cases where the DBAs are not trusted, use of external key sources is required.
No Comments Yet
No comments yet.
Comments RSS TrackBack Identifier URI
Leave a comment
