Improving Web Application Security: Threats and - CGISecurity

676 Part V: Assessing Your SecuritySQL Server Logins, Users, and RolesAuthorization in SQL Server is managed through SQL Server logins, database users,and a variety of different types of roles. Review the following questions to ensurethese roles are configured appropriately:● Do you have a strong sa (system administrator) password?Make sure the sa account has a strong password.Important The sa account is still active even when you change from SQL authentication toWindows authentication.●Also make sure you have applied strong passwords to all database accounts,particularly privileged accounts, for example, members of sysadmin anddb_owner. If you use replication, check that the distributer_admin account hasa strong password.Have you removed the SQL Server guest account?If when you installed SQL Server the Windows Guest account was enabled, a SQLServer guest account is created. Check each database and ensure that the SQLServer guest account is not present. If it is, remove it.Note You cannot remove guest from the master, tempdb, and replication and distributiondatabases.●●●●Have you removed the BUILTIN\Administrators server login?If your company differentiates the role of domain administrator and databaseadministrator, remove the BUILTIN\Administrators SQL Server login. It is a goodidea to create a specific Windows group containing specific databaseadministrations in its place.Have you removed permissions for the public role?Review the permissions granted to the public role in each database. Make sure ithas no permissions to access any database objects.How many members are there that belong to the sysadmin role?Check how many logins belong to the sysadmin role. Ideally, no more than twousers should be system administrators.Do you grant restricted database permissions to logins?Review the permissions granted to each database user account and make sure thateach account (including application accounts) only has the minimum requiredpermissions.