Improving Web Application Security: Threats and - CGISecurity

526 Part IV: Securing Your Network, Host and Application To audit failed actions across the file system1. Start Windows Explorer and navigate to the root of the file system.2. Right-click the root of the file system, and then click Properties.3. Click the Security tab.4. Click Advanced, and then click the Auditing tab.5. Click Add, and then enter Everyone into the object name to select field.6. Click OK, and then select the Full Control check box in the Failed column to auditall failed events.By default, this applies to the current folder and all subfolders and files.7. Click OK three times to close all open dialog boxes.Failed audit events are logged to the Windows security event log.Enable SQL Server Login AuditingBy default, SQL Server login auditing is not enabled. Minimally, you should auditfailed logins. Auditing failed login attempts is a useful way of detecting an attackerwho is trying to crack account passwords. For more information, about how to enableSQL Server auditing, see “Step 10: SQL Server Security.”Additional ConsiderationsThe following are additional measures to consider when auditing and logging:● Consider shutting down the system if unable to log security audits. This policyoption is set in the Security Options of the Local Security Settings managementconsole. Consider this setting for highly secure servers.●Consider C2 level auditing. SQL Server offers an auditing capability thatcomplies with the U.S. Government C2 certification. C2 level auditing providessubstantially more audit information at the expense of increased disk storagerequirements.For more information about the configuration of a C2-compliant system, see theTechNet article “SQL Server 2000 C2 Administrator’s and User’s Security Guide”at http://www.microsoft.com/technet/prodtechnol/sql/maintain/security/sqlc2.asp?frame=true#d.