Improving Web Application Security: Threats and - CGISecurity

Chapter 14: Building Secure Data Access 399SummaryData Privacy and Integrity on the NetworkIf you use SQL authentication to connect to SQL Server, ensure that login credentialsare not exposed over the network. Either install a certificate on the database server(which causes SQL Server to encrypt the credentials) or use an IPSec encryptedchannel to the database.The use of IPSec or SSL to the database is recommended to protect sensitiveapplication level data passed to and from the database. For more information, seeChapter 18, “Securing Your Database Server.”This chapter showed the top threats to data access code and highlighted the commonvulnerabilities. SQL injection is one of the main threats to be aware of. Unless you usethe correct countermeasures discussed in this chapter, an attacker could exploit yourdata access code to run arbitrary commands in the database. Conventional securitymeasures such as firewalls and SSL provide no defense to SQL injection attacks. Youshould thoroughly validate your input and use parameterized stored procedures as aminimum defense.Additional ResourcesFor more information, see the following resources:●●●●●For a printable checklist, see “Checklist: Securing Data Access” in the “Checklists”section of this guide.For information on securing your developer workstation, see “How To: SecureYour Developer Workstation” in the “How To” section of this guide.For information on using SSL with SQL Server, see “How To: Use SSL to SecureCommunication with SQL Server 2000,” in the “How To” section of “Microsoftpatterns & practices Volume I, Building Secure ASP.NET Applications: Authentication,Authorization, and Secure Communication” at http://msdn.microsoft.com/library/en-us/dnnetsec/html/SecNetHT19.asp.For information on using IPSec, see “How To: Use IPSec to Provide SecureCommunication Between Two Servers” in the “How To” section of “Microsoftpatterns & practices Volume I, Building Secure ASP.NET Applications: Authentication,Authorization, and Secure Communication” at http://msdn.microsoft.com/library/en-us/dnnetsec/html/SecNetHT18.asp.For information on using DPAPI, see “How To: Create a DPAPI Library” in the“How To” section of “Microsoft patterns & practices Volume I, Building SecureASP.NET Applications: Authentication, Authorization, and Secure Communication”at http://msdn.microsoft.com/library/en-us/dnnetsec/html/SecNetHT07.asp.