Improving Web Application Security: Threats and - CGISecurity

516 Part IV: Securing Your Network, Host and ApplicationDelete or Disable Unused AccountsUnused accounts and their privileges may be a haven for an attacker who has gainedaccess to a server. Audit local accounts on the server and delete those that are unused.The recommendation is to first disable an account to see if this causes any problemsbefore deleting the account, because deleted accounts cannot be recovered. Note thatthe administrator account and guest account cannot be deleted.Note During SQL Server 200 SP3 installation, Sqldbreg2.exe creates the SQL Debugger account.Visual Studio .NET uses this account when debugging stored procedures from managed .NET code.Because this account is only used to support debugging, you can delete it from production databaseservers.Disable the Windows Guest AccountThe Windows guest account is the account used when an anonymous connection ismade to the computer. To restrict anonymous connections to your database server,keep this account disabled. By default, the guest account in Windows 2000 isdisabled. To see if it is enabled, display the Users folder in the ComputerManagement tool. It is represented by a cross icon. If it isn’t disabled, display itsProperties dialog box and select the Account is disabled check box.Rename the Administrator AccountThe default local administrator account is a target for malicious use because of itshigh privileges on the computer. To improve security, rename the defaultadministrator account and assign it a strong password.Enforce Strong Password PolicyTo counter password guessing and brute force dictionary attacks, apply strongpassword policies by configuring security policy. The keys to strong account andpassword policies are:● Set password length and complexity. Enforcing strong passwords reduces thechance of successful password guessing or dictionary attacks.●Set password expiration. Regularly expiring passwords reduces the chance thatan old password will be used for unauthorized access. The expiration period istypically guided by a company’s security policy.Table 18.3 shows the default and recommended password policy settings.