Improving Web Application Security: Threats and - CGISecurity

524 Part IV: Securing Your Network, Host and ApplicationWhen you install SQL Server, it creates the following registry entries and subentries:●For a default instance:HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\MSSQLSERVER●For a named instance:HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\MICROSOFT SQL SERVER\INSTANCENAME●For the SQL service:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSSQLSERVERIn this step, you:● Verify permissions for the SQL Server registry keys.●Secure the SAM (stand-alone servers only).Verify Permissions for the SQL Server Registry KeysUse Regedt32.exe to verify the Everyone group does not have permissions on theSQL Server registry keys, listed above. The following controls are in place by default:Administrators: Full ControlSQL Server service account: Full ControlNote The Microsoft Baseline Security Analyzer will verify the registry permissions. Use the tool asan alternative to manually verifying the permissions with Regedt32.exe.Secure the SAM (Stand-alone Servers Only)Stand-alone servers store account names and one-way password hashes (LMHash) inthe local SAM database, which is part of the registry. Generally, only members of theAdministrators group have access to the account information.Although the passwords are not actually stored in the SAM and password hashes arenot reversible, if an attacker obtains a copy of the SAM database, he or she can usebrute force password cracking techniques to obtain valid credentials.Restrict LMHash storage in the SAM by creating the key (not value) NoLMHash inthe registry as shown below.HKLM\System\CurrentControlSet\Control\LSA\NoLMHashFor more information, see Microsoft Knowledge Base article 299656, “New RegistryKey to Remove LM Hashes from Active Directory and Security Account Manager.”