Improving Web Application Security: Threats and - CGISecurity

Chapter 18: Securing Your Database Server 521● Evaluate the performance cost. The use of EFS incurs a performance penalty.Test EFS before using it in your scenario to determine the actual performanceimpact. Usually the performance penalty is negligible because the data file isdecrypted by SQL Server when the process starts.To implement EFS, right-click the directory, click Advanced, and then clickEncrypt contents to be secure. For more information about EFS, see the followingresources:● Microsoft Knowledge Base article 23050, “How To: Encrypt Data Using EFS inWindows 2000.”● TechNet article, “Step-by-Step Guide to Encrypting File System (EFS)” athttp://www.microsoft.com/technet/treeview/default.asp?url=/technet/prodtechnol/windows2000serv/deploy/walkthru/efsguide.asp.Step 6. SharesRemove any unused shares and harden the NTFS permissions on any requiredshares. By default, all users have full control on newly created file shares. Hardenthese default permissions to make sure that only authorized users can access filesexposed by the share. Also, use NTFS ACLs on files and folders exposed by the sharein addition to explicit share permissions.In this step, you:● Remove unnecessary shares.●Restrict access to required shares.Remove Unnecessary SharesRemove all unnecessary shares. To review shares, start the Computer ManagementMMC snap-in and select Shares under Shared Folders.Restrict Access to Required SharesRemove the Everyone group and grant specific permissions instead. Everyone is usedwhen you do not have restrictions on who has access to the share.Additional ConsiderationsIf you are not allowing remote administration of the computer, remove unusedadministrative shares, for example, C$ and Admin$.Note Some applications may require administrative shares such as Microsoft ManagementServer (SMS) or Microsoft Operations Manager (MOM). For more information, see MicrosoftKnowledge Base article 318751, “How To: Remove Administrative Shares in Windows 2000 orWindows NT 4.0.”