Improving Web Application Security: Threats and - CGISecurity

672 Part V: Assessing Your SecurityAccountsReview the accounts used on your database server by answering the followingquestions:● Do you use a least privileged account to run SQL Server?Review which account you use to run SQL Server and make sure it is a leastprivileged account. It should not be an administrative account or the powerfullocal system account. Also make sure that the account is not a member of theUsers group on the local computer.● Have you deleted or disabled unused accounts?Audit local accounts on the server and check that all unused accounts aredisabled.● Have you disabled the Guest account?Check that the Windows Guest account is disabled to restrict anonymousconnections to your database server.● Have you created a new administrator account?The default local administrator account is a prime target for attack. To improvesecurity, check that you have created a new custom account for administration andthat the default Administrator account has been disabled.●●●Do you use strong password policies?Use the Local Security Policy tool to review password policy. For informationabout the recommended password policy, see “Step 4. Accounts” in Chapter 18,“Securing Your Database Server.”Do you restrict remote logons?Check the user rights assignments within the Local Security Policy tool to ensurethat the Everyone group is not granted the “Access this computer from thenetwork” user right.Have you disabled null sessions?Check that null sessions are disabled to prevent anonymous (unauthenticated)sessions from being created with your server. To check this, run Regedt32.exe andconfirm that the RestrictAnonymous key is set to 1, as shown below.HKLM\System\CurrentControlSet\Control\LSA\RestrictAnonymous=1●Do clients connect by using Windows authentication?If so, check that the strongest version of NTLM authentication (NTLMv2) isenabled and enforced. To check that NTLMv2 authentication is enforced, use theLocal Security Policy Tool. Expand Local Policies and select Security Options andthen double-click LAN Manager Authentication Level. Verify that Send NTLMv2response only\refuse LM & NTLM is selected.