Building Secure ASP.NET Applications - People Search Directory

At a Glance xxxix
Chapter 12 – Data Access Security
This chapter presents recommendations and guidance that will help you develop
a secure data access strategy. The key issues covered by this chapter are shown in
Figure 11. These include storing connection strings securely, using an appropriate
identity for database access, securing data passed to and from the database, using
an appropriate authentication mechanism and implementing authorization in the
database.
4
Windows or SQL
(Authentication)
Client
Identity
Client
Application
(for example
ASP.NET)
2
Data
Access
Identity
SQL
Server
SQL Server
1
Secure
Connection
String Storage
3
SSL or IPSec
(Privacy/Integrity)
5
Database
Permissions
(Authorization)
Figure 11
Data Access security overview
Read this chapter to learn how to:
● Use Windows authentication from ASP.NET to your database.
● Secure connection strings.
● Use DPAPI from ASP.NET Web applications to store secrets such as connection
strings and credentials.
● Store credentials for authentication securely in a database.
● Validate user input to protect against SQL injection attacks.
● Mitigate the security threats associated with the use of SQL authentication.
● Know which type of database roles to use.
● Compare and contrast database user roles with SQL Server application roles.
● Secure communication to SQL Server using IPSec and also SSL.
● Create a least privilege database account.
● Enable auditing in SQL Server.