If you have any additional questions that aren’t addressed in the blog, feel free to contact me. I’d be more than happy to help you out!
V-40951
Title: “SQL Server must support the organizational requirement to employ automated mechanisms for enforcing access restrictions.”
Severity = Medium
Details = Obtain the SQL Server software library installation directory location.
From a command prompt, type regedit.exe, and press [ENTER].
Navigate to HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> Microsoft SQL Server >> Instance Names. Each instance installed on the server possesses a key inside a folder under this registry entry.
Analysis Services Instances are registered in the OLAP subfolder.
Reporting Services Instances are registered in the RS subfolder.
Standard SQL Server Instances are registered in the SQL subfolder.
Inside each one of these folders, a single key is used to reference an instance’s specific Windows Registry tree. Each key will have its own registry tree at the following registry location: HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> Microsoft SQL Server >> [INSTANCE NAME].
An [INSTANCE NAME] is listed as the data component of a key found in one of the above OLAP, RS, or SQL folders.
To find the installation location of a particular instance, navigate to the following location in the Windows Registry:
HKEY_LOCAL_MACHINE >> SOFTWARE >> Microsoft >> Microsoft SQL Server >> [INSTANCE NAME] >> Setup. Examine the value of the ‘SqlProgramDir’ key. The value of the ‘SqlProgramDir’ key is the SQL Server installation directory for that SQL Server Instance.
Navigate to that folder location using a command prompt or Windows Explorer. Note any custom subdirectories within the SQL Server software library directory. Only applications that are required for the functioning and administration of SQL Server should be located in the same disk directory as the SQL Server software libraries.
If any directories or files not installed with the SQL Server software exist within the SQL Server software library directory, this is a finding.
FIX: Install SQL Server software using directories separate from the OS and other application software library directories.
Relocate any directories or reinstall other application software that currently shares the DBMS software library directory to separate directories.
Recommend dedicating a separate partition for the SQL software libraries.
This is pretty self explanatory. You should never install your SQL Server on the default “C” drive. Let your SAN team, or Windows Admin team know that you will need separate disk partitions. For example, the installation files can reside on the “E” drive, data file on the “F” drive and the log file on the “G” drive.
MSDN has a great article that addresses security considerations for a SQL Server installation. Read the article here. I also highly recommend buying a great book by Denny Cherry called, “Securing SQL Server.” I did a review of the book that you can read here.