V-79069 - Unsure how to proceed

[potatoqualitee]

Don't know what this means or what constitutes sensitive

Alter sensitive tables to utilize system versioning.

-- suggested fix
ALTER TABLE InsurancePolicy
ADD PERIOD FOR SYSTEM_TIME (SysStartTime, SysEndTime),
SysStartTime datetime2 GENERATED ALWAYS AS ROW START HIDDEN NOT NULL DEFAULT GETUTCDATE(),
SysEndTime datetime2 GENERATED ALWAYS AS ROW END HIDDEN NOT NULL DEFAULT CONVERT(DATETIME2, '9999-12-31 23:59:59.99999999');
ALTER TABLE InsurancePolicy SET (SYSTEM_VERSIONING = ON (HISTORY_TABLE=dbo.InsurancePolicyHistory));

https://docs.microsoft.com/sql/t-sql/statements/alter-table-transact-sql?view=sql-server-2016#system_versionin

[potatoqualitee]

Maybe a command to check if temporal tables even exist?

[potatoqualitee]

Have organization determine what is sensitive information

[wsmelton]

It is not necessarily sensitive data but versioning of data and ensuring certain columns are in place to ensure integrity of that historical change.

https://www.stigviewer.com/stig/ms_sql_server_2016_database/2018-03-09/finding/V-79069

From the 2016 SQL STIG:

Non-repudiation of actions taken is required in order to maintain data integrity. Examples of particular actions taken by individuals include creating information, sending a message, approving information (e.g., indicating concurrence or signing a contract), and receiving a message. Non-repudiation protects against later claims by a user of not having created, modified, or deleted a particular data item or collection of data in the database. In designing a database, the organization must define the types of data and the user actions that must be protected from repudiation. The implementation must then include building audit features into the application data tables and configuring SQL Server's audit tools to capture the necessary audit trail. Design and implementation also must ensure that applications pass individual user identification to SQL Server, even where the application connects to SQL Server with a standard, shared account. Applications should use temporal tables to track the changes and history of sensitive data.

[potatoqualitee]

Thanks so much! My documentation creator dropped off the Description which had this info, so I ended up adding it back.