Improving Web Application Security: Threats and - CGISecurity

730 Improving Web Application Security: Threats and CountermeasuresServicesCheck DescriptionUnnecessary Microsoft Windows ® services are disabled on the database server.All optional services, including Microsoft Search Service, MSSQLServerADHelper, andSQLServerAgent, are disabled if not used by any applications.The Microsoft Distributed Transaction Coordinator (MS DTC) is disabled if it is not beingused by any applications.A least-privileged local/domain account is used to run the various SQL Server services,for example, back up and replication.ProtocolsCheck DescriptionAll protocols except TCP/IP are disabled within SQL Server. Check this using the ServerNetwork Utility.The TCP/IP stack is hardened on the database server.AccountsCheck DescriptionSQL Server is running using a least-privileged local account (or optionally, a least-privilegeddomain account if network services are required).Unused accounts are removed from Windows and SQL Server.The Windows guest account is disabled.The administrator account is renamed and has a strong password.Strong password policy is enforced.Remote logons are restricted.Null sessions (anonymous logons) are restricted.Approval is required for account delegation.Shared accounts are not used.Membership of the local administrators group is restricted (ideally, no more than twoadministration accounts).