Checks

Default service accounts should not be used - consider creating specialised service accounts for individual purposes.

Users with service account access at folder level can impersonate any service account. Instead, they should be given access to particular service accounts as required.

Default service accounts should not be used - consider creating specialised service accounts for individual purposes.

Service accounts should have a minimal set of permissions assigned in order to do their job. They should never have excessive access as if compromised, an attacker can escalate privileges and take over the entire account.

Default service accounts should not be used - consider creating specialised service accounts for individual purposes.

Users with service account access at organization level can impersonate any service account. Instead, they should be given access to particular service accounts as required.

The default network which is provided for a project contains multiple insecure firewall rules which allow ingress to the project's infrastructure. Creation of this network should therefore be disabled.

Users with service account access at project level can impersonate any service account. Instead, they should be given access to particular service accounts as required.

RSA SHA1 is a weaker algorithm than SHA2-based algorithms such as RSA SHA256/512

DNSSEC authenticates DNS responses, preventing MITM attacks and impersonation.

Temporary files are not logged by default. To log all temporary files, a value of 0 should set in the log_temp_files flag - as all files greater in size than the number of bytes set in this flag will be logged.

In-transit data should be encrypted so that if traffic is intercepted data will not be exposed in plaintext to attackers.

Logging connections provides useful diagnostic data such as session length, which can identify performance issues in an application and potential DoS vectors.

Database instances should be configured so that they are not available over the public internet, but to internal compute resources which access them.

Setting the minimum log severity too high will cause errors not to be logged

Cross-database ownership chaining, also known as cross-database chaining, is a security feature of SQL Server that allows users of databases access to other databases besides the one they are currently using.

Lock waits are often an indication of poor performance and often an indicator of a potential denial of service vulnerability, therefore occurrences should be logged for analysis.

Logging of statements which could contain sensitive data is not advised, therefore this setting should preclude all statements from being logged.

Logging disconnections provides useful diagnostic data such as session length, which can identify performance issues in an application and potential DoS vectors.

Users with ALTER permissions on users can grant access to a contained database without the knowledge of an administrator

Automated backups are not enabled by default. Backups are an easy way to restore data in a corruption or data-loss scenario.

Logging checkpoints provides useful diagnostic data, which can identify performance issues in an application and potential DoS vectors.

Arbitrary files can be read from the system using LOAD_DATA unless this setting is disabled.

Opening up ports to allow connections from the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.