Improving Web Application Security: Threats and - CGISecurity

502 Part IV: Securing Your Network, Host and ApplicationHow to Use This ChapterThis chapter provides a methodology and steps for securing a database server. Themethodology can be adapted for your own scenario. The steps put the methodologyinto practice.To gain the most from this chapter:● Read Chapter 2, “Threats and Countermeasures.” This chapter provides anexplanation of potential threats faced by Web applications and downstreamdatabase servers.● Use the snapshot. The section, “Snapshot of a Secure Database Server,” later inthis chapter lists the attributes of a secure database server. It reflects distilled inputfrom a variety of sources including customers, industry experts, and internalMicrosoft development and support teams. Use the snapshot table as a referencewhen configuring your database server.● Use the checklist. The “Checklist: Securing Your Database Server” in the“Checklist” section of this guide provides a quick reference. Use the checklist toquickly evaluate the scope of the required steps and to help you work through theindividual steps.● Use the “How To” section. The “How To” section in this guide includes thefollowing instructional articles that help you implement the guidance in thischapter:● “How To: Use Microsoft Security Baseline Analyzer”● “How To: Use IPSec”● “How To: Implement Patch Management”Threats and CountermeasuresAn attacker can target and compromise a database server in a number of ways byexploiting a variety of configuration and application level vulnerabilities.The main threats to a database server are:● SQL injection● Network eavesdropping● Unauthorized server access● Password crackingFigure 18.1 shows the major threats and vulnerabilities that can result in acompromised database server and the potential destruction or theft of sensitive data.