<div>
Thanks. This is very helpful. Yes I use XCCDF more and more with the STIG benchmarks.<br />
<br />
I am aware of the move in this direction.<br />
<br />
I will check these things out.<br />
<br />
Thanks!
</div>


<div>
One more question. I use the DISA supplied XCCDF benchmarks for other scans, such as Windows OS. &nbsp;I use the SCAP engine in Retina.<br />
<br />
I may have misunderstood, but is there an XCCDF file supplied by DISA that I can use to scan SQL 2008?
</div>


<div>
They are not creating any based on latest faq, as time line is not stated. Maybe the mitre forum on xccdf and oval can share if they see any but probably not from DISA
</div>


<div>
Thanks! I will keep an eye on that.
</div>


<div>
<div class="content wysiwyg-content">
I am configuring SQL 2008 servers for DISA compliance. &nbsp;It looks like the latest STIG is for 2005 (DISA web site and NIST web site).<br />
<br />
I download the CIS guide and am working with that, as it contains code snippets.<br />
<br />
Can anyone direct me to a set of scripts for SQL 2008 that similar to what &nbsp;the DISA scripts do for Oracle? <br />
<br />
Thanks
</div>
</div>


I am configuring SQL 2008 servers for DISA compliance.  It looks like the latest STIG is for 2005 (DISA web site and NIST web site).

I download the CIS guide and am working with that, as it contains code snippets.

Can anyone direct me to a set of scripts for SQL 2008 that similar to what  the DISA scripts do for Oracle? 

Thanks

Thanks. This is very helpful. Yes I use XCCDF more and more with the STIG benchmarks.

I am aware of the move in this direction.

I will check these things out.

Thanks!

One more question. I use the DISA supplied XCCDF benchmarks for other scans, such as Windows OS.  I use the SCAP engine in Retina.

I may have misunderstood, but is there an XCCDF file supplied by DISA that I can use to scan SQL 2008?

They are not creating any based on latest faq, as time line is not stated. Maybe the mitre forum on xccdf and oval can share if they see any but probably not from DISA

MS SQL 2008 Hardening Guide

Microsoft SQL Server is a suite of relational database management system (RDBMS) products providing multi-user database access functionality.SQL Server is available in multiple versions, typically identified by release year, and versions are subdivided into editions to distinguish between product functionality. Component services include integration (SSIS), reporting (SSRS), analysis (SSAS), data quality, master data, T-SQL and performance tuning.

Microsoft SQL Server

Security is the protection of information systems from theft or damage to the hardware, the software, and the information on them, as well as from disruption or misdirection of the services they provide. The main goal of security is protecting assets, and an asset is anything of value and worthy of protection.  Information Security is a discipline of protecting information assets from threats through safeguards to achieve the objectives of confidentiality, integrity, and availability or CIA for short. On the other hand, disclosure, alteration, and disruption (DAD) compromise the security objectives.