Ensure Databases are Encrypted with TDE

MediaNivel 2Automatizadamssql

Descripción

Ensure user databases are encrypted using Transparent Data Encryption (TDE). Backups of databases encrypted with TDE are automatically encrypted as well. Runs one sqlcmd query with its defaults (Windows authentication to the local default instance); set SQLCMDSERVER, SQLCMDUSER and SQLCMDPASSWORD for another instance or SQL authentication. Needs VIEW SERVER STATE / sysadmin-level read access.

Cómo se verifica

Método de auditoría: Consulta SQL

sql_query

sqlcmd -b -h -1 -W -Q "SET NOCOUNT ON; SELECT COUNT(*) FROM sys.databases WHERE database_id > 4 AND is_encrypted <> 1;"

Salida esperada: 0

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Implement TDE encryption on each user database with sensitive data. More info on how to do this is available here: https://learn.microsoft.com/en- us/sql/relational-databases/security/encryption/transparent-data-encryption

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: mssqldatabaseencryption
Referencia: CIS Microsoft SQL Server 2025 Benchmark v1.0.0 - 7.5 Ensure Databases are Encrypted with TDE

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target mssql --level 2