Improving Web Application Security: Threats and - CGISecurity

xxxviiiImproving Web Application Security: Threats and CountermeasuresChecklistSecuring Your Database Server 729How to Use This Checklist ....................................................................................... 729Installation Considerations for Production Servers..................................................... 729Patches and Updates .............................................................................................. 729Services................................................................................................................. 730Protocols................................................................................................................ 730Accounts................................................................................................................ 730Files and Directories ............................................................................................... 731Shares................................................................................................................... 731Ports...................................................................................................................... 731Registry ................................................................................................................. 731Auditing and Logging ............................................................................................... 732SQL Server Security ................................................................................................ 732SQL Server Logins, Users, and Roles........................................................................ 732SQL Server Database Objects.................................................................................. 733Additional Considerations ........................................................................................ 733Staying Secure........................................................................................................ 733ChecklistSecurity Review for Managed Code 735How to Use This Checklist ....................................................................................... 735General Code Review Guidelines .............................................................................. 735Managed Code Review Guidelines ............................................................................ 735Assembly-Level Checks ....................................................................................... 735Class-Level Checks ............................................................................................. 736Cryptography ...................................................................................................... 736Secrets .............................................................................................................. 737Exception Management ....................................................................................... 737Delegates........................................................................................................... 737Serialization ....................................................................................................... 737Threading ........................................................................................................... 738Reflection........................................................................................................... 738Unmanaged Code Access .................................................................................... 738Resource Access Considerations ............................................................................. 739File I/O .............................................................................................................. 739Event Log ........................................................................................................... 739Registry ............................................................................................................. 739Environment Variables ......................................................................................... 740Code Access Security Considerations ....................................................................... 740