Improving Web Application Security: Threats and - CGISecurity

Chapter 18: Securing Your Database Server 513Disable Unused SQL Server ServicesDuring a SQL Service installation, the following four Windows services are installed:● MSSQLSERVER (or MSSQL$InstanceName for a named instance). This is theSQL Server database engine and is the only mandatory service.● SQLSERVERAGENT (or SQLAgent$InstanceName for a named instance). Withthis support service, you can schedule commands and notify operators whenerrors occur.● MSSQLServerADHelper. This provides Active Directory integration services,including database instance registration.● Microsoft Search. This provides full text search capabilities. This service mustalways run under the local system account.Only the MSSQLSERVER database engine is required. The remaining servicesprovide additional functionality and are required only in specific scenarios. Disablethese services if they are not required.Note SQL Server should not be configured to run as the local System account or any account thatis a member of the local Administrators group. For details about configuring the service accountused to run MSSQLSERVER, see “Step 4: Accounts.”Disable the Microsoft DTC (if not required)If you do not use distributed transactions through the Microsoft DTC, disable theservice.Step 3. ProtocolsBy preventing the use of unnecessary protocols, you reduce the surface area of attack.Configure SQL Server to support only clients that connect using the TCP/IP protocol.Disable all other protocols, unless required.In this step, you:● Restrict SQL Server to TCP/IP.●Harden the TCP/IP Stack.