Improving Web Application Security: Threats and - CGISecurity

xxviiiImproving Web Application Security: Threats and CountermeasuresStep 5. Files and Directories.................................................................................... 519Verify Permissions on SQL Server Install Directories .............................................. 519Verify Everyone Group Does Not Have Permissions for SQL Server Files .................. 520Secure Setup Log Files........................................................................................ 520Secure or Remove Tools, Utilities, and SDKs ......................................................... 520Additional Considerations .................................................................................... 520Step 6. Shares ....................................................................................................... 521Remove Unnecessary Shares .............................................................................. 521Restrict Access to Required Shares...................................................................... 521Additional Considerations .................................................................................... 521Step 7. Ports.......................................................................................................... 522Restrict Access to the SQL Server Port................................................................. 522Configure Named Instances to Listen on the Same Port......................................... 522Configure the Firewall to Support DTC Traffic (if necessary) .................................... 523Additional Considerations .................................................................................... 523Step 8. Registry...................................................................................................... 523Verify Permissions for the SQL Server Registry Keys .............................................. 524Secure the SAM (Stand-alone Servers Only) .......................................................... 524Step 9. Auditing and Logging ................................................................................... 525Log All Failed Windows Logon Attempts ................................................................ 525Log All Failed Actions Across the File System ........................................................ 525Enable SQL Server Login Auditing......................................................................... 526Additional Considerations .................................................................................... 526Step 10. SQL Server Security................................................................................... 527Set SQL Server Authentication to Windows Only .................................................... 527Set SQL Server Audit Level to Failure or All ........................................................... 528Run SQL Server Using a Least Privileged Account.................................................. 528Step 11. SQL Server Logins, Users, and Roles.......................................................... 529Use a Strong sa (System Administrator) Password................................................. 530Remove the SQL Guest User Account ................................................................... 530Remove the BUILTIN\Administrators Server Login.................................................. 530Do Not Grant Permissions for the Public Role........................................................ 531Additional Considerations .................................................................................... 531Step 12. SQL Server Database Objects .................................................................... 532Remove the Sample Databases ........................................................................... 532Secure Stored Procedures ................................................................................... 532Secure Extended Stored Procedures..................................................................... 532Restrict cmdExec Access to the sysadmin Role ..................................................... 532Snapshot of a Secure Database Server .................................................................... 533Additional Considerations ........................................................................................ 536Staying Secure........................................................................................................ 536Perform Regular Backups .................................................................................... 537Audit Group Membership ..................................................................................... 537Monitor Audit Logs.............................................................................................. 537Stay Current with Service Packs and Patches ........................................................ 537