📝 Google Cloud SQL Server Instance user options Database Flag is configured 🟢

• Contextual name: 📝 SQL Server Instance user options Database Flag is configured 🟢
• ID: /ce/ca/google/sql/sqlserver-instance-user-options-flag
• Located in: 📁 Google Cloud SQL

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Disable 'user options' Flag for SQL Server Instances

Logic

• 🧠 prod.logic.yaml 🟢
  • 📗 Google Cloud SQL Instance
  • 🔌 Google Cloud SQL Instance - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

It is recommended that, user options database flag for Cloud SQL SQL Server instance should not be configured.

Rationale

The user options option specifies global defaults for all users. A list of default query processing options is established for the duration of a user's work session. The user options option allows you to change the default values of the SET options (if the server's default settings are not appropriate).

A user can override these defaults by using the SET statement. You can configure user options dynamically for new logins. After you change the setting of user options, new login sessions use the new setting; current login sessions are not affected. This recommendation is applicable to SQL Server database instances.

Impact

Setting custom flags via command line on certain instances will cause all omitted flags to be reset to defaults. This may cause you to lose custom flags and could result in unforeseen complications or instance restarts. Because of this, it is recommended you apply these flags changes during a period of low usage.

... see more

Remediation

Open File

Remediation

From Google Cloud Console

1. Go to the Cloud SQL Instances page in the Google Cloud Console by visiting https://console.cloud.google.com/sql/instances.
2. Select the SQL Server instance for which you want to enable to database flag.
3. Click Edit.
4. Scroll down to the Flags section.
5. Click the X next user options flag shown
6. Click Save to save your changes.
7. Confirm your changes under Flags on the Overview page.

From Google Cloud CLI

1. List all Cloud SQL database Instances

        gcloud sql instances list

2. Clear the user options database flag for every Cloud SQL SQL Server database instance using either of the below commands.

Clearing all flags to their default value

        gcloud sql instances patch <INSTANCE_NAME> --clear-database-flags

OR

To clear only user options database flag, configure the database flag by overriding the user options. Exclude user options flag and its value, and keep all other flags you want to configure.

        gcloud sql instances patch <INSTANCE_NAME> --database-flags [FLAG1=VALUE1,FLAG2=VALUE2]

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS GCP v1.2.0 → 💼 6.3.4 Ensure 'user options' database flag for Cloud SQL SQL Server instance is not configured - Level 1 (Automated)			1
💼 CIS GCP v1.3.0 → 💼 6.3.4 Ensure 'user options' database flag for Cloud SQL SQL Server instance is not configured - Level 1 (Automated)			1
💼 CIS GCP v2.0.0 → 💼 6.3.4 Ensure 'user options' database flag for Cloud SQL SQL Server instance is not configured - Level 1 (Automated)			1
💼 CIS GCP v3.0.0 → 💼 6.3.4 Ensure 'user options' database flag for Cloud SQL SQL Server instance is not configured - Level 1 (Automated)			1
💼 Cloudaware Framework → 💼 Secure Access			53
💼 FedRAMP High Security Controls → 💼 CM-1 Policy and Procedures (L)(M)(H)			3
💼 FedRAMP High Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)	3	1	24
💼 FedRAMP High Security Controls → 💼 CM-6 Configuration Settings (L)(M)(H)	2		12
💼 FedRAMP High Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)	3	18	33
💼 FedRAMP High Security Controls → 💼 CM-9 Configuration Management Plan (M)(H)			8
💼 FedRAMP High Security Controls → 💼 SA-3 System Development Life Cycle (L)(M)(H)			4
💼 FedRAMP High Security Controls → 💼 SA-8 Security and Privacy Engineering Principles (L)(M)(H)			6
💼 FedRAMP High Security Controls → 💼 SA-10 Developer Configuration Management (M)(H)			3
💼 FedRAMP Low Security Controls → 💼 CM-1 Policy and Procedures (L)(M)(H)			3
💼 FedRAMP Low Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)			23
💼 FedRAMP Low Security Controls → 💼 CM-6 Configuration Settings (L)(M)(H)			11
💼 FedRAMP Low Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)			29
💼 FedRAMP Low Security Controls → 💼 SA-3 System Development Life Cycle (L)(M)(H)			4
💼 FedRAMP Low Security Controls → 💼 SA-8 Security and Privacy Engineering Principles (L)(M)(H)			6
💼 FedRAMP Moderate Security Controls → 💼 CM-1 Policy and Procedures (L)(M)(H)			3
💼 FedRAMP Moderate Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)	3		24
💼 FedRAMP Moderate Security Controls → 💼 CM-6 Configuration Settings (L)(M)(H)	1		12
💼 FedRAMP Moderate Security Controls → 💼 CM-7 Least Functionality (L)(M)(H)	3		33
💼 FedRAMP Moderate Security Controls → 💼 CM-9 Configuration Management Plan (M)(H)			8
💼 FedRAMP Moderate Security Controls → 💼 SA-3 System Development Life Cycle (L)(M)(H)			4
💼 FedRAMP Moderate Security Controls → 💼 SA-8 Security and Privacy Engineering Principles (L)(M)(H)			6
💼 FedRAMP Moderate Security Controls → 💼 SA-10 Developer Configuration Management (M)(H)			3
💼 ISO/IEC 27001:2022 → 💼 8.1 User end point devices		8	13
💼 ISO/IEC 27001:2022 → 💼 8.9 Configuration management			12
💼 NIST CSF v1.1 → 💼 PR.IP-1: A baseline configuration of information technology/industrial control systems is created and maintained incorporating security principles (e.g. concept of least functionality)		4	26
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events			134
💼 NIST CSF v2.0 → 💼 GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed			6
💼 NIST CSF v2.0 → 💼 GV.OV-01: Cybersecurity risk management strategy outcomes are reviewed to inform and adjust strategy and direction			3
💼 NIST CSF v2.0 → 💼 GV.PO-01: Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced			3
💼 NIST CSF v2.0 → 💼 GV.PO-02: Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission			3
💼 NIST CSF v2.0 → 💼 GV.SC-03: Cybersecurity supply chain risk management is integrated into cybersecurity and enterprise risk management, risk assessment, and improvement processes			10
💼 NIST CSF v2.0 → 💼 ID.AM-08: Systems, hardware, software, services, and data are managed throughout their life cycles			21
💼 NIST CSF v2.0 → 💼 ID.IM-01: Improvements are identified from evaluations			20
💼 NIST CSF v2.0 → 💼 ID.IM-02: Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties			33
💼 NIST CSF v2.0 → 💼 ID.IM-03: Improvements are identified from execution of operational processes, procedures, and activities			34
💼 NIST CSF v2.0 → 💼 ID.RA-09: The authenticity and integrity of hardware and software are assessed prior to acquisition and use			4
💼 NIST CSF v2.0 → 💼 PR.DS-10: The confidentiality, integrity, and availability of data-in-use are protected			108
💼 NIST CSF v2.0 → 💼 PR.IR-03: Mechanisms are implemented to achieve resilience requirements in normal and adverse situations			11
💼 NIST SP 800-53 Revision 5 → 💼 CM-1 Policy and Procedures			3
💼 NIST SP 800-53 Revision 5 → 💼 CM-2 Baseline Configuration	7		23
💼 NIST SP 800-53 Revision 5 → 💼 CM-6 Configuration Settings	4		12
💼 NIST SP 800-53 Revision 5 → 💼 CM-7 Least Functionality	9		23
💼 NIST SP 800-53 Revision 5 → 💼 CM-9 Configuration Management Plan	1		8
💼 NIST SP 800-53 Revision 5 → 💼 SA-3 System Development Life Cycle	3		4
💼 NIST SP 800-53 Revision 5 → 💼 SA-8 Security and Privacy Engineering Principles	33		7
💼 NIST SP 800-53 Revision 5 → 💼 SA-10 Developer Configuration Management	7		3
💼 PCI DSS v3.2.1 → 💼 1.1 Establish and implement firewall and router configuration standards	7	1	38
💼 PCI DSS v3.2.1 → 💼 1.1.6 Documentation of business justification and approval for use of all services, protocols, and ports allowed, including documentation of security features implemented for those protocols considered to be insecure.		1	27
💼 PCI DSS v3.2.1 → 💼 1.1.7 Requirement to review firewall and router rule sets at least every six months.			8
💼 PCI DSS v3.2.1 → 💼 1.4 Install personal firewall software or equivalent functionality on any portable computing devices that connect to the Internet when outside the network, and which are also used to access the CDE.			8
💼 PCI DSS v3.2.1 → 💼 1.5 Ensure that security policies and operational procedures for managing firewalls are documented, in use, and known to all affected parties.			8
💼 PCI DSS v3.2.1 → 💼 2.2 Develop configuration standards for all system components. Assure that these standards address all known security vulnerabilities and are consistent with industry-accepted system hardening standards.	5	3	30
💼 PCI DSS v3.2.1 → 💼 2.5 Ensure that security policies and operational procedures for managing vendor defaults and other security parameters are documented, in use, and known to all affected parties.			8
💼 PCI DSS v4.0.1 → 💼 1.1.1 All security policies and operational procedures identified in Requirement 1 are documented, kept up to date, in use, and known to all affected parties.			8
💼 PCI DSS v4.0.1 → 💼 1.2.1 Configuration standards for NSC rulesets are defined, implemented, maintained.			34
💼 PCI DSS v4.0.1 → 💼 1.2.5 All services, protocols, and ports allowed are identified, approved, and have a defined business need.			27
💼 PCI DSS v4.0.1 → 💼 1.2.6 Security features are defined and implemented for all services, protocols, and ports that are in use and considered to be insecure, such that the risk is mitigated.			27
💼 PCI DSS v4.0.1 → 💼 1.2.7 Configurations of NSCs are reviewed at least once every six months to confirm they are relevant and effective.			8
💼 PCI DSS v4.0.1 → 💼 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks and the CDE.			8
💼 PCI DSS v4.0.1 → 💼 2.1.1 All security policies and operational procedures identified in Requirement 2 are documented, kept up to date, in use, and known to all affected parties.			8
💼 PCI DSS v4.0.1 → 💼 2.2.1 Configuration standards are developed, implemented, and maintained.			11
💼 PCI DSS v4.0 → 💼 1.1.1 All security policies and operational procedures identified in Requirement 1 are documented, kept up to date, in use, and known to all affected parties.			8
💼 PCI DSS v4.0 → 💼 1.2.1 Configuration standards for NSC rulesets are defined, implemented, maintained.		24	34
💼 PCI DSS v4.0 → 💼 1.2.5 All services, protocols, and ports allowed are identified, approved, and have a defined business need.		15	27
💼 PCI DSS v4.0 → 💼 1.2.6 Security features are defined and implemented for all services, protocols, and ports that are in use and considered to be insecure, such that the risk is mitigated.		6	27
💼 PCI DSS v4.0 → 💼 1.2.7 Configurations of NSCs are reviewed at least once every six months to confirm they are relevant and effective.			8
💼 PCI DSS v4.0 → 💼 1.5.1 Security controls are implemented on any computing devices, including company- and employee-owned devices, that connect to both untrusted networks and the CDE.			8
💼 PCI DSS v4.0 → 💼 2.1.1 All security policies and operational procedures identified in Requirement 2 are documented, kept up to date, in use, and known to all affected parties.			8
💼 PCI DSS v4.0 → 💼 2.2.1 Configuration standards are developed, implemented, and maintained.			11
💼 SOC 2 → 💼 CC7.1-2 Monitors Infrastructure and Software		8	11
💼 SOC 2 → 💼 CC7.1-3 Implements Change-Detection Mechanisms			3
💼 SOC 2 → 💼 CC7.1-4 Detects Unknown or Unauthorized Components			3
💼 SOC 2 → 💼 CC8.1-1 Manages Changes Throughout the System Lifecycle			3
💼 SOC 2 → 💼 CC8.1-2 Authorizes Changes			3
💼 SOC 2 → 💼 CC8.1-3 Designs and Develops Changes			3
💼 SOC 2 → 💼 CC8.1-4 Documents Changes			3
💼 SOC 2 → 💼 CC8.1-5 Tracks System Changes			3
💼 SOC 2 → 💼 CC8.1-6 Configures Software			3
💼 SOC 2 → 💼 CC8.1-7 Tests System Changes			3
💼 SOC 2 → 💼 CC8.1-8 Approves System Changes			3
💼 SOC 2 → 💼 CC8.1-9 Deploys System Changes			3
💼 SOC 2 → 💼 CC8.1-10 Identifies and Evaluates System Changes			3
💼 SOC 2 → 💼 CC8.1-11 Identifies Changes in Infrastructure, Data, Software, and Procedures Required to Remediate Incidents			3
💼 SOC 2 → 💼 CC8.1-12 Creates Baseline Configuration of IT Technology			3
💼 SOC 2 → 💼 CC8.1-13 Provides for Changes Necessary in Emergency Situations			3
💼 SOC 2 → 💼 CC8.1-14 Manages Patch Changes			3
💼 SOC 2 → 💼 CC8.1-15 Considers System Resilience			3