← Back to MS SQL Server 2014 Database Security Technical Implementation Guide

V-213780

CAT II (Medium)

Database Master Key passwords must not be stored in credentials within the database.

Rule ID

SV-213780r961128_rule

STIG

MS SQL Server 2014 Database Security Technical Implementation Guide

Version

V1R7

CCIs

CCI-001199

Discussion

Storage of the Database Master Key password in a database credential allows decryption of sensitive data by privileged users who may not have a need-to-know requirement to access the data.

Check Content

From the query prompt:
SELECT COUNT(credential_id)
FROM [master].sys.master_key_passwords

If count is not 0, this is a finding.

Fix Text

Use the stored procedure sp_control_dbmasterkey_password to remove any credentials that
store Database Master Key passwords.
From the query prompt:
EXEC SP_CONTROL_DBMASTERKEY_PASSWORD @db_name = '<database name>', @action
= N'drop'