Quick Start Guide: MSSQL Database Scanning w/ Integrated Security (GUI)

Overview

This guide will walk through remotely scanning a domain-joined Microsoft SQL Database using CIS-CAT Pro Assessor v4 GUI. If the Database is not domain joined, please see the this guide: https://cisecurity.atlassian.net/l/cp/cgtfNpKt

Requirements

  • Windows target machine hosting the SQL server is domain-joined

  • SQL Authentication Mode is set to Mixed Mode (SQL and Windows Authentication)

  • User conducting scan has sysadmin permissions

Implementation Steps

Open the GUI

Select Advanced ā†’ Add remote or local target system

Fill out the appropriate information as shown below:

Scroll down and add the Benchmark. Once you select the Benchmark and press ā€˜Addā€™ you will be prompted for the JDBC string:

An example connection string could look like below:

jdbc:sqlserver://CIS-SERVER:1433;integratedSecurity=true;

Once the JDBC string is built and the Test Connection is successful, select OK

Select ā€˜Saveā€™ on the bottom right to move to the Target Systems page

Select ā€˜Nextā€™ on the bottom right to move to the final page

On the final page, select the reporting options and logging level:

Once the options are configured to your liking, select next and the scan will begin

Troubleshooting Steps

If the scan is unsuccessful, check the SQL logs for a ā€™Login failed for user' message that matches the username in your JDBC string. Hereā€™s a way to get SQL logs: View the SQL Server error log (SSMS) - SQL Server

Check that the WinRM connection is properly configured: WinRM troubleshooting for remote CIS-CAT Pro assessment of a Windows target system

See this section of the documentation for more information on JDBC string structure:

Ā 


Ā 

Copyright Ā© 2022 Center for Internet SecurityĀ® Privacy Policy

Ā 


Ā