Improving Web Application Security: Threats and - CGISecurity

Chapter 14: Building Secure Data Access 397Deployment ConsiderationsA securely designed and developed data access component can still be vulnerable toattack if it is not deployed in a secure manner. A common deployment practice is forthe data access code and database to reside on separate servers. The servers are oftenseparated by an internal firewall, which introduces additional deploymentconsiderations. Developers and administrators, be aware of the following issues:● Firewall restrictions● Connection string management● Login account configuration● Logon auditing● Data privacy and integrity on the networkFirewall RestrictionsIf you connect to SQL Server through a firewall, configure the firewall, client, andserver. You configure the client by using the SQL Server Client Network Utility andyou configure the database server by using the Server Network Utility. By default,SQL Server listens on TCP port 1433, although you can change this. You must openthe chosen port at the firewall.Depending on the SQL Server authentication mode you choose and yourapplication’s use of distributed transactions, you may need to open several additionalports at the firewall:● If your application uses Windows authentication to connect to SQL Server, thenecessary ports to support Kerberos or NTLM authentication must be open.For networks that do not use Active Directory, TCP port 139 is usually required forWindows authentication. For more information about port requirements, seeTechNet articles, “TCP and UDP Port Assignments,” at http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/tcpip/part4/tcpappc.asp, and “SecurityConsiderations for Administrative Authority,” at http://www.microsoft.com/technet/security/bestprac/bpent/sec2/seconaa.asp●If your application uses distributed transactions, for example automated COM+transactions, you might also need to configure your firewall to allow DTC trafficto flow between separate DTC instances, and between the DTC and resourcemanagers such as SQL Server.For full configuration details, see the “Ports” section in Chapter 18, “Securing YourDatabase Server.”