Security faults with software applications and operating systems are discovered daily. Vendor-supported software and patches must be evaluated and patched against newly found vulnerabilities. Some of the functions and services, provided by default, may not be necessary to support essential.

Information systems are capable of providing a wide variety of functions and services. SQL Server must have the SQL Server Data Tools (SSDT) software component removed from SQL Server if SSDT is unused. Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to.

SQL Server databases in the classified environment, containing classified or sensitive information, must be encrypted using approved cryptography.Ĭryptography is only as strong as the encryption modules/algorithms employed to encrypt the data. SQL Server must recover to a known state that is verifiable.Īpplication recovery and reconstitution constitutes executing an information system contingency plan comprising activities that restore essential missions and business functions. Preventing the disclosure of transmitted information requires that applications take measures to employ some form of cryptographic mechanism in order to protect the information during. SQL Server must employ cryptographic mechanisms preventing the unauthorized disclosure of information during transmission. Findings (MAC III - Administrative Classified) Finding ID