Improving Web Application Security: Threats and - CGISecurity

Chapter 18: Securing Your Database Server 511Steps for Securing Your Database ServerThis section guides you through the process of securing your database server usingthe configuration categories introduced earlier. The steps cover Windows 2000 andSQL Server 2000. Each step may contain one or more actions to secure a particulararea or feature.Step 1Patches and UpdatesStep 7PortsStep 2ServicesStep 8RegistryStep 3ProtocolsStep 9Auditing and LoggingStep 4AccountsStep 10SQL Server SecurityStep 5Files and DirectoriesStep 11SQL Server Logins, Users, and RolesStep 6SharesStep 12SQL Server Database ObjectsStep 1. Patches and UpdatesFailure to apply the latest patches and updates in a timely manner means that you areproviding opportunities for attackers to exploit known vulnerabilities. You shouldverify that your database server is updated with the latest Windows 2000 and SQLServer service packs and updates.Important Make sure to test patches and updates on test systems that mirror your productionservers as closely as possible before applying them on production servers.Detect Missing Service Packs and UpdatesUse the Microsoft Baseline Security Analyzer (MBSA) to detect the necessaryWindows and SQL Server updates that may be missing. MBSA uses an XML file asthe reference of existing updates. This XML file is either downloaded by MBSA whena scan runs, or the file can be downloaded on the local server or from a networkserver. To detect and install patches and updates1. Download and install MBSA.You can do this from the MBSA home page at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/tools/Tools/mbsahome.asp.If you do not have Internet access when you run MBSA, it will not be able toretrieve the XML file containing the latest security settings from Microsoft. In thisevent, download the XML file manually and put it in the MBSA program directory.The XML file is available from http://download.microsoft.com/download/xml/security/1.0/nt5/en-us/mssecure.cab.