Synergetic databases and applications require adequate security configuration through multiple layers of the environment. They main objective of this exercise is to protect the database and system availability to ensure that confidential data is kept private and the system is secured and continually accessible to users who need access. This review focuses on helping to improve system security, however for improved business continuity practices it is recommended to also consider additional options that may provide improved performance, high availability and disaster recovery. The key focus points of this template are for hardening security configuration within a Synergetic environment across the following layers:
- Information Security Management
- Network Security
- Database Security
- Web Server Security
- Application SecurityDatabase
- Supporting Services Security
Refer to Synergetic Data Privacy and Security Information Sheet - Synergetic User Hub - Synergetic Wiki for a top level overview.
...
| Seq | Recommended Controls | Control Reference | R* | Findings | Risk Rating (Critical, High, Medium, Low) |
|---|---|---|---|---|---|
| 1 | Local administrators group is restricted on the SQL Servers | Management of privileged access rights A.9.2.3 | Y | ||
| 2 | Remote Desktop/server access to SQL Servers:
| Management of privileged access rights A.9.2.3 | P | ||
| 3 | Service Accounts
| Management of privileged access rights A.9.2.3 CIS 3.5-3.7 | P | ||
| 4 | File shares and permissions
| Management of privileged access rights A.9.2.3 | P | ||
| 5 | Synergetic data and backup files are protected
| Access Control -Access control policy A.9.1.1 | |||
| 6 | Database backups are performed
| Backup A.12.3 | P | ||
| 7 | Database Version
| CIS 1.1 | Y | ||
| 8 | Database Security
| CIS 1.2 | Y | ||
| 9 | Database Security - use of 'sa' account
OR
**Renaming of 'sa' account is not supported by Synergetic, even if it is disabled it must still exist as 'sa' | CIS 2.13 | P | ||
| 10 | Database Security - server level SQL logins limited to:
| Synergetic Security - Best Practices | Y | ||
| 11 | Database Auditing and Logging
| CIS 5.1 | Y | ||
| 12 | Database Logon auditing
**Important note - this can be considered however note that it will increase the SQL event log size significantly. Please use with caution and monitor disk/log size. | CIS 5.4 | Y | ||
| 13 | Database Security
| Synergetic Security - Best Practices | Y | ||
| 14 | Database Security - Orphaned users
| CIS 3.3 | |||
| 15 | Database Security - Fixed SQL Server Roles
| Synergetic Security - Best Practices | P | ||
| 16 | Database Security - Fixed SQL Database Roles
| Synergetic Security - Best Practices | Y | ||
| 17 | Database Administration - Synergetic Fixed Database Roles
| Synergetic Security - Best Practices | Y | ||
| 18 | Direct Database Permissions for users and third party service accounts
| Synergetic Security - Best Practices | P | ||
| 19 |
| Cryptography A.10 | Y | ||
| 20 | ^Ensure 'Remote Access' Server Configuration Option is set to '0' | CIS 2.6 | Y | ||
| 21 | ^Ensure Unnecessary SQL Server Protocols are set to 'Disabled' | CIS 2.10 | Y | ||
| 22 | ^Ensure 'Hide Instance' option is set to 'Yes' for Production For named instance Synergetic config does not allow supplying port number, so needs the browser service to recognise it. | CIS 2.12 | Y | ||
| 23 | ^Ensure 'CHECK_EXPIRATION' Option is set to 'ON' for All SQL **Note that Windows auth is preferred for users & third party vendors so this should not normally apply. | CIS 4.2 | |||
| 24 | ^Ensure 'MUST_CHANGE' Option is set to 'ON' for All SQL **Note that Windows auth is preferred for users & third party vendors so this should not normally apply.Authenticated Logins | CIS 4.3 |
...
*R= can be assessed remotely without input from stakeholders - y = YES P=Partially but additional info required from the stakeholders.
...
SUPPORTING SERVICES SECURITY
| Seq | Recommended Controls | Control Reference | R* | Findings | Risk Rating (Critical, High, Medium, Low) |
|---|---|---|---|---|---|
| 1 | If DocMan Import Service is used:
| Synergetic Security - Best Practices | Y | ||
| 2 | Services run under low level domain user account | Synergetic Security - Best Practices | Y |
...