Improving Web Application Security: Threats and - CGISecurity

Chapter 22: Deployment Review 677SQL Server Database ObjectsReview the following questions to ensure that you have removed unnecessarydatabase objects, including the sample databases, and that stored procedures areappropriately secured.● Have you removed sample databases?Use SQL Server Enterprise Manager to check that all sample databases, includingPubs and Northwind, have been removed.● Have you secured stored procedures?Check to make sure that neither the public role nor the guest user has access toany of your stored procedures. To authorize access to stored procedures, youshould map the SQL Server login of your server to a database user, place thedatabase user in a user-defined database role, and then apply permissions to thisrole to provide execute access to the stored procedures of your application.●Have you restricted access to cmdExec?The cmdExec function is used by the SQL Server Agent to execute Windowscommand-line applications and scripts that are scheduled by the SQL ServerAgent. Check that access to cmdExec is restricted to members of the sysadminrole.To check this, use SQL Server Enterprise Manager to expand the Managementnode. Right-click SQL Server Agent and display the SQL Server Agent Propertiesdialog box. Click the Job System tab and check that Only users with SysAdminprivileges can execute CmdExec and ActiveScripting job steps is selected.Network ConfigurationThe goal for this phase of the review is to identify vulnerabilities in the configurationof your network. For further background information about the issues raised by thereview questions in this section, see Chapter 15, “Securing Your Network.”To help focus and structure the review process, the review questions have beendivided into the following configuration categories:● Router● Firewall● Switch