Microsoft SQL Server 2016 Security Checklist (Y26M01)

20 items · Security · Hard difficulty · 4 hours

Essential security steps to harden SQL Server 2016 and meet STIG guidance.

• Backup all databases and system databases

  Create full backups of user DBs plus master, msdb, and model before changes.

• Apply latest SQL Server cumulative updates and security patches

  Install Microsoft CUs and security updates for SQL Server 2016.

• Restart SQL Server services after patching

  Restart to complete patch installation and verify service health.

• Enforce least-privilege service accounts

  Run SQL services under dedicated, low-privileged domain or local accounts.

• Restrict membership in the sysadmin fixed server role

  Remove unnecessary accounts and document required sysadmin users.

• Disable or remove unused features and services

  Turn off SQL Browser, unused endpoints, and unneeded components.

• Disable xp_cmdshell and other unsafe extended procedures

  Turn off or restrict extended procedures that allow OS access.

• Enforce strong password policies and account lockout

  Apply complexity, expiration, and lockout via Windows or SQL policies.

• Enable and enforce TLS encryption for data in transit

  Install valid certs and force encryption on SQL endpoints.

• Configure Transparent Data Encryption (TDE) for sensitive DBs

  Enable TDE and manage keys with secure key backup and storage.

• Enable and configure auditing

  Turn on audits to capture security-relevant server and DB events.

• Create server and database audit specifications

  Include logins, schema changes, privilege use, and admin actions.

• Route audit logs to a secure external destination (SIEM)

  Forward logs to SIEM or WEF to prevent local tampering.

• Configure regular vulnerability scans and STIG compliance checks

  Use DISA STIG XCCDF, CIS tools, or vulnerability scanners regularly.

• Harden database permissions and remove public access

  Grant least privilege for schemas, roles, and objects.

• Secure backups and test restore procedures

  Encrypt backups, store offsite, and validate restores regularly.

• Maintain and review SQL Server logs and failed login alerts

  Monitor error logs, agent logs, and configure alerts for failures.

• Apply OS hardening and firewall rules for SQL ports

  Harden Windows host and restrict TCP/1433 (and other) access.

• Disable or harden legacy authentication protocols

  Disable NTLM where possible and prefer Kerberos or modern auth.

• Document configuration, patch schedule, and recovery plans

  Keep runbooks, change logs, and contacts up to date.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.