Improving Web Application Security: Threats and - CGISecurity

Chapter 18: Securing Your Database Server 515Step 4. AccountsFollow the principle of least privilege for the accounts used to run and connect toSQL Server to restrict the capabilities of an attacker who manages to execute SQLcommands on the database server. Also apply strong password policies to counter thethreat of dictionary attacks.In this step, you:● Secure the SQL Server service account.●●●●●●Delete or disable unused accounts.Disable the Windows guest account.Rename the administrator account.Enforce strong password policy.Restrict remote logins.Disable null sessions (anonymous logons).Secure the SQL Server Service AccountRun the SQL Server service using a least privileged account to minimize the damagethat can be done by an attacker who manages to execute operating system commandsfrom SQL Server. The SQL Server service account should not be granted elevatedprivileges such as membership to the Administrators group. To create a new account to run the SQL Server service1. Start the Computer Management tool, and then expand Local Users and Groups.2. Right-click the Users folder, and then click New User.3. Create a new user making sure you use a strong password.In the New User dialog box, clear the User must change password at next logoncheck box, and then select the User cannot change password and Password neverexpires check boxes.4. Remove the new account from the Users group because this group is grantedliberal access across the computer.You can now configure SQL Server to run using this new account. For moreinformation, see “Step 10: SQL Server Security.”Accessing the Network from SQL ServerIf you need to access network resources from SQL Server, for example to performnetwork backups, for replication or log shipping, the SQL Server service accountmust be capable of being authenticated across the network. You have two choices.Either create a duplicate local account with the same name and password on theremote server, or use a least privileged domain account.