Improving Web Application Security: Threats and - CGISecurity

Chapter 14: Building Secure Data Access 373Use Windows AuthenticationIdeally, your design should use Windows authentication for the added securitybenefits. With Windows authentication, you do not have to store database connectionstrings with embedded credentials, credentials are not passed over the network, andyou benefit from secure account and password management policies. You dohowever need to carefully consider which account you will use to connect toSQL Server using Windows authentication.For more information, see “Authentication” later in this chapter.Use Least Privileged AccountsYour application should use a least privileged account that has limited permissions inthe database. Be sure that the application login to the database is appropriatelyauthorized and restricted. For details, see “Authorization” later in this chapter.Using least privileged accounts reduces risk and limits the potential damage if youraccount is compromised or malicious code is injected. In the case of SQL injection, thecommand executes under the security context defined by the application login and issubject to the associated permissions that the login has in the database. If you connectusing an overprivileged account — for example, as a member of the SQL Serversysadmin role — the attacker can perform any operation in any database on theserver. This includes inserting, updating, and deleting data; dropping tables; andexecuting operating system commands.Important Do not connect to SQL Server using the sa account or any account that is a member ofthe SQL Server sysadmin or db_owner roles.Use Stored ProceduresStored procedures offer performance, maintenance, and security benefits. Useparameterized stored procedures for data access where possible. The security benefitsinclude:● You can restrict the application database login so that it only has permission toexecute specified stored procedures. Granting direct table access is unnecessary.This helps mitigate the risk posed by SQL injection attacks.●Length and type checks are performed on all input data passed to the storedprocedure. Also, parameters cannot be treated as executable code. Again, thismitigates the SQL injection risk.If you cannot use parameterized stored procedures for some reason and you need toconstruct SQL statements dynamically, do so using typed parameters and parameterplaceholders to ensure that input data is length and type checked.