TMA-MSSQL-7.3
Ensure Database Backups are Encrypted
Beschreibung
Ensure Database Backups are Encrypted Counts recorded backups in msdb history that were neither backup-encrypted nor taken from a TDE database. Runs one sqlcmd query with its defaults (Windows authentication to the local default instance); set SQLCMDSERVER, SQLCMDUSER and SQLCMDPASSWORD for another instance or SQL authentication. Needs VIEW SERVER STATE / sysadmin-level read access.
So wird geprüft
Prüfmethode: SQL-Abfrage
sqlcmd -b -h -1 -W -Q "SET NOCOUNT ON; SELECT COUNT(*) FROM msdb.dbo.backupset b INNER JOIN sys.databases d ON b.database_name = d.name WHERE b.key_algorithm IS NULL AND b.encryptor_type IS NULL AND d.is_encrypted = 0;"- Erwartete Ausgabe
0
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
SQL Server backups need to 'Back up to a new media set', not 'Back up to the existing media set' in order to allow for encryption. The backup option to Encrypt Backup can be implemented after a Certificate or Asymmetric key has been applied to the SQL Server for this purpose. Alternatively, encrypt the database with TDE. This automatically encrypts the backups as well. See 7.5
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- mssqldatabaseencryptionbackup
- Referenz
- CIS Microsoft SQL Server 2025 Benchmark v1.0.0 - 7.3 Ensure Database Backups are Encrypted
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
tmaegis scan --target mssql --level 2