Improving Web Application Security: Threats and - CGISecurity

Chapter 21: Code Review 641Search for the “Connection” string to locate instances of ADO .NET connectionobjects and review how the ConnectionString property is set.●●●●Do you encrypt the connection string?Check that the code retrieves and then decrypts an encrypted connection string.The code should use DPAPI for encryption to avoid key management issues.Do you use a blank password?Do not. Check that all SQL accounts have strong passwords.Do you use the sa account or other highly privileged accounts?Do not use the sa account or any highly privileged account, such as members ofsysadmin or db_owner roles. This is a common mistake. Check that you use aleast privileged account with restricted permissions in the database.Do you use Persist Security Info?Check that the Persist Security Info attribute is not set to true or yes becausethis allows sensitive information, including the user name and password, to beobtained from the connection after the connection has been opened.How Do You Restrict Unauthorized Code?If you have written a data access class library, how do you prevent unauthorizedcode from accessing your library to access the database? One approach is to useStrongNameIdentityPermission demands to restrict the calling code to only thatcode that has been signed with specific strong name private keys.How Do You Secure Sensitive Data in the Database?If you store sensitive data, such as credit card numbers, in the database, how do yousecure the data? You should check that it is encrypted by using a strong symmetricencryption algorithm such as 3DES.If you use this approach, how do you secure the 3DES encryption key? Your codeshould use DPAPI to encrypt the 3DES encryption key and store the encrypted key ina restricted location such as the registry.Do You Handle ADO .NET Exceptions?Check that all data access code is placed inside try/catch blocks and that the codehandles the SqlExceptions, OleDbExceptions or OdbcExceptions, depending on theADO .NET data provider that you use.