Improving Web Application Security: Threats and - CGISecurity

Chapter 22: Deployment Review 675Auditing and LoggingReview the following questions to check whether or not you have used appropriateauditing and logging on your database server.● Have you enabled SQL Server auditing?Check that SQL Server auditing is enabled. Make sure that the Audit level settingon the Security page of the SQL Server Properties dialog box in EnterpriseManager is set to either All or Failure.●●Do you log all failed logon attempts?Use the Local Security Policy tool to check that you have enabled the auditingof failed logon attempts.Do you log all failed actions across the file system?Use the Local Security Policy tool to check that you have enabled object accessauditing. Then check that auditing has been enabled across the file system.SQL Server SecurityReview which authentication mode your SQL Server is configured to use. You can seethis by viewing the Security page of your server’s Properties dialog box in EnterpriseManager. If your server is configured to support SQL Server and Windowsauthentication, check that your applications do require SQL authentication. Ifpossible, use Windows only authentication.If your applications do require SQL authentication, review how they managedatabase connection strings. This is important if they use SQL authentication becausethey contain user name and passwords. Also ensure that a server certificate isinstalled on the database server to ensure that credentials are encrypted when theyare passed over the network to the database server, or that transport level encryptionis used.