Improving Web Application Security: Threats and - CGISecurity

518 Part IV: Securing Your Network, Host and ApplicationAdditional ConsiderationsConsider the following steps to improve security for your database server:●●●●●Require approval for account delegation. Do not mark domain accounts astrusted for delegation in Active Directory without special approval.Do not use shared accounts. Do not create shared account for use by multipleindividuals. Give authorized individuals their own accounts. The activities ofindividuals can be audited separately and group membership and privilegesappropriately assigned.Restrict the local Administrators group membership. Ideally, have no more thantwo administration accounts. This helps provide accountability. Also, do not sharepasswords, again to provide accountability.Limit the administrator account to interactive logins. If you perform only localadministration, you can restrict your administrator account to interactive logonsby removing the “Access this computer from the network” user right to denynetwork logon rights. This prevents users (well intentioned or otherwise) fromremotely logging on to the server using the administrator account. If a policy oflocal administration is too inflexible, implement secure remote administration.For more information about remote administration, see “Remote Administration”later in this chapter.Enable NTLMv2 authentication. If client computers connect to your databaseserver by using Windows authentication, you should configure your databaseserver to use the strongest version of Windows authentication, which is NTLMv2.Note To support NTLMV2, clients must be running Windows 2000, Windows Server 2003, orWindows NT ® operating system version 4.0 with Service Pack 4. To enable NTLMv2 authentication from the Local Security Policy Tool1. Expand Local Policies, select Security Options, and then double-click LANManager Authentication Level.2. Select Send NTLMv2 response only\refuse LM & NTLM.This is the most secure setting.Note This is equivalent to setting the HKLM\System\CurrentControlSet\Control\Lsa\LMCompatibilityLevel DWORD value to 5.