Microsoft SQL Server 2022 Security Checklist (STIG)

17 items · Security · Hard difficulty · 3 hours

Essential steps to secure Microsoft SQL Server 2022 per the STIG.

• Verify FIPS-compliant OS deployment

  Ensure the host OS uses FIPS 140-2/3 validated crypto modules.

• Apply latest SQL Server patches and cumulative updates

  Install Microsoft's latest security updates and cumulative patches.

• Apply Windows and network STIGs to the database host

  Implement OS and network STIG controls that affect the DBMS host.

• Restrict sysadmin and high-privilege logins

  Remove unnecessary members and audit privileged accounts.

• Secure or disable the 'sa' account

  Disable, rename, or set a strong password for the built-in SA account.

• Harden SQL Server instance configuration
• Disable xp_cmdshell

  Prevent execution of OS commands from within SQL Server.

• Disable SQL CLR if not required

  Remove SQLCLR assemblies to reduce attack surface.

• Disable ad hoc distributed queries

  Turn off OPENROWSET/OPENDATASOURCE if not needed.

• Configure least privilege for SQL Server service accounts

  Use dedicated, non-interactive accounts with minimal rights.

• Install and bind a valid TLS certificate for SQL Server

  Use a trusted certificate to enable encrypted connections.

• Force TLS encrypted connections

  Require encryption for client and inter-node connections.

• Enable Transparent Data Encryption (TDE) or equivalent

  Encrypt data at rest to protect database files and backups.

• Configure and retain comprehensive audit logging

  Enable audit of logins, schema changes, and privileged actions.

• Configure host and network firewall rules for SQL ports

  Restrict access to SQL Server ports to authorized IPs and hosts.

• Regularly backup system and user databases and secure backups

  Schedule backups and store them encrypted and access-controlled.

• Enforce strong authentication and password policies; enable MFA for admins where possible

  Use complex passwords and MFA for privileged accounts.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.