Improving Web Application Security: Threats and - CGISecurity

Chapter 18: Securing Your Database Server 517Table 18.3 Password Policy Default and Recommended SettingsPassword Policy Default Setting Recommended Minimum SettingEnforce password history 1 password remembered 24 passwords rememberedMaximum password age 42 days 42 daysMinimum password age 0 days 2 daysMinimum password length 0 characters 8 charactersPasswords must meet complexityrequirementStrong password using reversibleencryption for all users in thedomainDisabledDisabledEnabledDisabledAdditionally, log failed login attempts to detect and trace malicious behavior. Formore information, see “Step 9: Auditing and Logging.”For more information about password policies, see password “Best Practices” on theMicrosoft TechNet Web site at http://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windowsserver2003/proddocs/entserver/windows_password_protect.asp.Restrict Remote LogonsUse the Local Security Policy tool to remove the “Access this computer from thenetwork” user right from the Everyone group to restrict who can log on to the serverremotely.Disable Null Sessions (Anonymous Logons)To prevent anonymous access, disable null sessions. These are unauthenticated oranonymous sessions established between two computers. Unless null sessions aredisabled, an attacker can connect to your server anonymously, that is, withoutrequiring authentication.As soon as an attacker establishes a null session, a variety of attacks can beperformed, including enumeration used to obtain system-related information fromthe target computer. The type of information that can be returned over a null sessionincludes domain and trust details, shares, user information including groups anduser rights, registry keys, and more. Disable them because they represent a significantsecurity threat.Restrict null sessions by setting RestrictAnonymous=1 in the registry at the followinglocation.HKLM\System\CurrentControlSet\Control\LSA\RestrictAnonymous=1For more information, see Microsoft Knowledge Base article 246261, “How To: Usethe RestrictAnonymous Registry Value in Windows 2000.”