Common Criteria Compliance Enabled Server Configuration
Applies to: SQL Server
The common criteria compliance option enables the following elements that are required for the Common Criteria for Information Technology Security Evaluation. A requirement for a world-wide compliance obligation across regulated industries and authorities.
|Residual Information Protection (RIP)
|RIP requires a memory allocation to be overwritten with a known pattern of bits before memory is reallocated to a new resource. Meeting the RIP standard can contribute to improved security; however, overwriting the memory allocation can slow performance. After the common criteria compliance enabled option is enabled, the overwriting occurs.
|The ability to view login statistics
|Login auditing is enabled after the common criteria compliance option is enabled.
Login times that are made available on a per-session basis each time a user successfully logs in to SQL Server:
- Information about the last successful login time
- The last unsuccessful login time
- The number of attempts between the last successful login and the current login.
These login statistics can be viewed by querying the sys.dm_exec_sessions dynamic management view.
GRANT shouldn't override table
|After the common criteria compliance enabled option is enabled, a table-level
DENY takes precedence over a column-level
GRANT. When the option isn't enabled, a column-level
GRANT takes precedence over a table-level
The common criteria compliance enabled option is an advanced option. Common criteria is only evaluated and certified for the Enterprise edition and Datacenter edition. For the latest status of common criteria certification, see the Microsoft SQL Server Common Criteria site.
In addition to enabling the common criteria compliance enabled option, you also must download and run a script that finishes configuring SQL Server to comply with Common Criteria Evaluation Assurance Level 4+ (EAL4+). You can download this script from the Microsoft SQL Server Common Criteria site.
If you're using the
sp_configure system stored procedure to change the setting, you can change common criteria compliance enabled only when show advanced options is set to 1. The setting takes effect after the server is restarted. The possible values are 0 and 1:
0 indicates that common criteria compliance isn't enabled (default).
1 indicates that common criteria compliance is enabled.
The following example enables common criteria compliance.
sp_configure 'show advanced options', 1;
sp_configure 'common criteria compliance enabled', 1;
RECONFIGURE WITH OVERRIDE;
Restart SQL Server.