V-271169

Discussion

Weak passwords may be easily guessed. When passwords are used to encrypt keys used for encryption of sensitive data, the confidentiality of all data encrypted using that key is at risk. Current DOD passwords require the following: - minimum of 15 characters; - at least one uppercase character; - one lowercase character; - one special character; - one numeric character, and - at least eight characters changed from the previous password.

Check Content

From the query prompt: 

SELECT name 
FROM [master].sys.databases 
WHERE state = 0 

Repeat for each database: 
From the query prompt: 

USE [database name] 
SELECT COUNT(name) 
FROM sys.symmetric_keys s, sys.key_encryptions k 
WHERE s.name = '##MS_DatabaseMasterKey##' 
AND s.symmetric_key_id = k.key_id 
AND k.crypt_type in ('ESKP', 'ESP2', 'ESP3')

If the value returned is zero, this is not applicable.

If the value returned is greater than zero, a Database Master Key exists and is encrypted with a password. 

Review procedures and evidence of password requirements used to encrypt Database Master Keys. 

If the passwords do not meet DOD password standards, this is a finding.