Improving Web Application Security: Threats and - CGISecurity

580 Part IV: Securing Your Network, Host, and Application To configure database access for your ASP.NET application1. Use the Computer Management tool to change the password of the local ASPNETaccount on the Web server to a known strong password.You need to do this so that you can create a mirrored account on the databaseserver.2. Change the password attribute on the element in Machine.configso that the ASP.NET worker process continues to run using the ASPNET account.Use Aspnet_setreg.exe to store the encrypted credentials in the registry.3. Create a local account on the database server with the same name (ASPNET) andstrong password on the database server.4. Create a local Windows group, such as ASPNETWebApp, on the database server,and then add the local ASPNET account to the group.5. Grant the Windows group access to SQL Server by creating a new login, asfollows:sp_grantlogin 'MACHINE\ASPNETWebApp'Note Replace MACHINE with your database server name.6. Grant the SQL login access to the database. The following T-SQL creates adatabase user called WebAppUser to which the login is associated.USE YourDatabaseGOsp_grantdbaccess 'MACHINE\ASPNETWebApp', 'WebAppUser'7. Create a user-defined database role.USE YourDatabaseGOsp_addrole 'WebAppUserRole'8. Add the database user to the new database role.USE YourDatabaseGOsp_addrolemember 'WebAppUserRole', 'WebAppUser'9. Configure permissions in the database for the database role. Ideally, grant executepermissions only for the stored procedures that the application uses to query thedatabase and do not provide direct table access.grant execute on sprocname to WebAppUserRole