Improving Web Application Security: Threats and - CGISecurity

Chapter 18: Securing Your Database Server 525Step 9. Auditing and LoggingAuditing does not prevent system attacks, although it is a vital aid in identifyingintruders, attacks in progress, and to diagnose attack footprints. It is important toenable all auditing mechanisms at your disposal, including Windows operatingsystem level auditing and SQL Server login auditing. SQL Server also supports C2level extended auditing. This may be required in specific application scenarios, whereauditing requirements are stringent.In this step, you:● Log all failed Windows login attempts.●●Log all failed actions across the file system.Enable SQL Server login auditing.Log All Failed Windows Logon AttemptsYou must log failed Windows logon attempts to be able to detect and trace maliciousbehavior. To audit failed logon attempts1. Start the Local Security Policy tool.2. Expand Local Policies and then select Audit Policy.3. Double-click Audit account logon events.4. Click Failure, and then click OK.Windows logon failures are recorded as events in the Windows security event log.The following event IDs are suspicious:● 531. This means an attempt was made to log on using a disabled account.●529. This means an attempt was made to log on using an unknown user account orusing a valid user account but with an invalid password. An unexpected increasein the number of these audit events might indicate an attempt to guess passwords.Log All Failed Actions Across the File SystemUse NTFS auditing on the file system to detect potentially malicious attempts. This isa two-step process: To enable logging1. Start the Local Security Policy tool.2. Expand Local Policies, and then select Audit Policy.3. Double click Audit object access.4. Click Failure, and then click OK.