2KKUU7ita

310
Part V: Hacking Applications
✓ Password hashes accessible through default/unprotected accounts
✓ Weak authentication methods enabled
✓ Database listener log files that can be renamed without authentication
A great all-in-one commercial database vulnerability scanner for performing
in-depth database checks — including user rights audits on SQL Server,
Oracle, and so on — is AppDetectivePro (www.appsecinc.com/products/
appdetective/). AppDetectivePro can be a good addition to your security
testing tool arsenal if you can justify the investment.
Many vulnerabilities can be tested from both an unauthenticated outsider’s
perspective as well as a trusted insider’s perspective. For example, you can
use the SYSTEM account for Oracle to log in, enumerate, and scan the system
(something that QualysGuard supports). My fingers are crossed that Qualys
will eventually support authenticated scans for SQL Server.
Following Best Practices for Minimizing
Database Security Risks
Keeping your databases secure is actually pretty simple if you do the
following:
✓ Run your databases on different machines.
✓ Check the underlying operating systems for security vulnerabilities. I
cover operating system exploits for Windows and Linux in Chapters 11
and 12, respectively.
✓ Ensure that your databases fall within the scope of patching and system
hardening.
✓ Require strong passwords on every database system.
✓ Use appropriate file and share permissions to keep prying eyes away.
✓ De-indentify any sensitive production data before it’s used in development
or QA.
✓ Check your web applications for SQL injection and related input validation
vulnerabilities.
✓ Use a network firewall, such as those available from Fortinet (www.
fortinet.com) or SonicWALL (www.sonicwall.com), and databasespecific
controls, such as those available from Pyn Logic (www.pynlogic.
com) and Idera (www.idera.com).