V-213904
SV-213904r960864_rule
CAT II
SQL Server must protect against a user falsely repudiating by ensuring databases are not in a trust relationship.
From: MS SQL Server 2016 Database Security Technical Implementation Guide (V3R5)
Description
<VulnDiscussion>Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message.
Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database.
SQL Server provides the ability for high privileged accounts to impersonate users in a database using the TRUSTWORTHY feature. This will allow members of the fixed database role to impersonate any user within the database. </VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
Check Procedure
If the database being reviewed is MSDB, trustworthy is required to be enabled, and therefore this is not a finding.
Execute the following query:
SELECT SUSER_SNAME(d.owner_sid) AS DatabaseOwner,
CASE
WHEN d.is_trustworthy_on = 0 THEN 'No'
WHEN d.is_trustworthy_on = 1 THEN 'Yes'
END AS IsTrustworthy,
CASE
WHEN role.name IN ('sysadmin','securityadmin')
OR permission.permission_name = 'CONTROL SERVER'
THEN 'YES'
ELSE 'No'
END AS 'IsOwnerPrivileged'
FROM sys.databases d
LEFT JOIN sys.server_principals login ON d.owner_sid = login.sid
LEFT JOIN sys.server_role_members rm ON login.principal_id = rm.member_principal_id
LEFT JOIN sys.server_principals role ON rm.role_principal_id = role.principal_id
LEFT JOIN sys.server_permissions permission ON login.principal_id = permission.grantee_principal_id
WHERE d.name = DB_NAME()
If trustworthy is not enabled, this is not a finding.
If trustworthy is enabled and the database owner is not a privileged account, this is not a finding.
If trustworthy is enabled and the database owner is a privileged account, review the system documentation to determine if the trustworthy property is required and authorized. If this is not documented, this is a finding.
Fix Text
Disable trustworthy on the database.
ALTER DATABASE [<database name>] SET TRUSTWORTHY OFF
CCI Reference
CCI-000166- Created
- 2026-02-12 15:25:32
- Last Updated
- 2026-04-07 20:09:49