Improving Web Application Security: Threats and - CGISecurity

536 Part IV: Securing Your Network, Host and ApplicationAdditional ConsiderationsIn addition to the steps described in this chapter, consider the following guidelines:● Install a certificate on the database server. If you use Windows authentication(NTLM or Kerberos), logon credentials are not passed over the network to SQLServer. If you use SQL authentication, it is a good idea to secure the credentialsbecause they are passed to SQL Server in unencrypted format. Do this byinstalling a certificate on the database server. This automatically results in theencryption of SQL credentials over the wire. It is also a good idea to make surethat your application securely stores database connection strings. For moreinformation, see Chapter 14, “Building Secure Data Access.”● Restrict access to sensitive commands and stored procedures. SQL Serverprovides powerful hooks into the operating system. For example, you can use thexp_cmdshell extended stored procedure to run any operating system command. Ifan attacker manages to run arbitrary commands in the database, for examplethrough a SQL injection vulnerability, the ability to execute operating systemcommands is limited only by the security credentials of the account used to runSQL Server. This is the primary reason for running SQL Server with a leastprivileged local account.● Use a dedicated computer as a database server. Also cluster it for failover.●●Physically protect the database server. Locate the server in a secure computerroom.Restrict local logons. Do not allow anyone to locally log on to the server, apartfrom the administrator.Staying SecureYou need to regularly monitor the security state of your database server and update itregularly to help prevent newly discovered vulnerabilities from being exploited. Tohelp keep your database server secure:● Perform regular backups.●●●●●Audit group membership.Monitor audit logs.Stay current with service packs and patches.Perform security assessments.Use security notification services.