Improving Web Application Security: Threats and - CGISecurity

674 Part V: Assessing Your SecurityPortsReview the ports that are active on your server to make sure that no unnecessaryports are available. For more information about using the netstat command to do this,see the “Ports” subsection in “Web Server Configuration,” earlier in this chapter.Then review the following questions:● Have you restricted access to the SQL Server port?Review how you restrict access to the SQL Server port. Check that your perimeterfirewall prevents direct access from the Internet. To protect against internalattacks, review your IPSec policies to ensure they limit access to the SQL Serverports.● Have you configured named instances to listen on the same port?If you use named instances, check with the Network Server Utility to verify thatyou have configured the instance to listen on a specific port. This avoids UDPnegotiation between the client and server, and means you do not need to openadditional ports.RegistryReview the security of your registry configuration with the following questions:●Have you secured the SQL Server registry keys?Use Regedt32.exe to check that the Everyone group has been removed from theACL attached to the following registry key.Administrators: Full ControlSQL Server service account: Full Control●Have you secured the SAM?Check that you have restricted LMHash storage in the Security Account Manager(SAM) by creating the key (not value) NoLMHash in the registry as shown below.HKLM\System\CurrentControlSet\Control\LSA\NoLMHashFor more information, see Microsoft Knowledge Base article 299656, “NewRegistry Key to Remove LM Hashes from Active Directory and Security AccountManager”.