Improving Web Application Security: Threats and - CGISecurity

508 Part IV: Securing Your Network, Host and Application●●●●●●PortsUnused ports are closed at the firewall, but it is required that servers behind thefirewall also block or restrict ports based on their usage. For a dedicated SQLServer, block all ports except for the necessary SQL Server port and the portsrequired for authentication.RegistrySQL Server maintains a number of security-related settings, including theconfigured authentication mode in the registry. Restrict and control access to theregistry to prevent the unauthorized update of configuration settings, for example,to loosen security on the database server.Auditing and LoggingAuditing is a vital aid in identifying intruders, attacks in progress, and to diagnoseattack footprints. Configure a minimum level of auditing for the database serverusing a combination of Windows and SQL Server auditing features.SQL Server SecurityA number of SQL Server security settings can be controlled through EnterpriseManager. These include the authentication mode, auditing level, and the accountsused to run the SQL Server service. For improved security, you should useWindows authentication. You should also enable SQL Server logon auditing andensure that the SQL Server service runs using a least privileged account.SQL Server Logins, Users, and RolesSQL Server 2000 manages access control using logins, databases, users, and roles.Users (and applications) are granted access to SQL Server by way of a SQL serverlogin. The login is associated with a database user and the database user is placedin one or more roles. The permissions granted to the role determine the tables thelogin can access and the types of operations the login can perform. This approachis used to create least privileged database accounts that have the minimum set ofpermissions necessary to allow them to perform their legitimate functionality.SQL Server Database ObjectsThe ability to access SQL Server database objects, such as built-in storedprocedures, extended stored procedures and cmdExec jobs, should be reviewed.Also, any sample databases should be deleted.