Ensure that the "3625" trace flag is turned off for all your Google Cloud SQL Server database instances to follow security best practices.
This rule resolution is part of the Conformity Security & Compliance tool for GCP.
The "3625" trace flag can be used to limit the information returned by some of the error messages triggered on the SQL Server databases, to non-administrator users. Setting this trace flag to a Google Cloud SQL Server database instance allows for security through obscurity and prevents the disclosure of sensitive information but it is strongly recommended to set this flag globally to off in order to prevent the flag having been left on, or turned on by malicious actors.
Note: Some database flag settings can affect instance availability and/or stability, and eventually remove the SQL Server instance from the Google Cloud SQL Service Level Agreement (SLA).
Audit
To determine if the "3625" trace flag is disabled for your SQL Server database instances, perform the following operations:
Remediation / Resolution
To turn off the "3625" trace flag for all your Google Cloud SQL Server database instances, perform the following operations:
References
- Google Cloud Platform (GCP) Documentation
- Cloud SQL for SQL Server documentation
- Configure database flags
- Edit instances
- CIS Security Documentation
- Securing Google Cloud Computing Platform
- GCP Command Line Interface (CLI) Documentation
- gcloud projects list
- gcloud sql instances list
- gcloud sql instances describe
- gcloud sql instances patch