Front cover - IBM Redbooks

Next, if MS SQL server is needed, it’s better to use an installed
implementation of the MS SQL server on some other machine. Database
applications need not be running on the same machine as the database
server.
Although it is possible to remove the MS SQL server subsystem from the
workstation or server, it’s probably best to just shut it down since there are too
many interdependencies among the components of the Windows operating
system versions to be 100% sure that deleting the subsystem components
won’t affect something else that depends on it later on.
Finally, if the MS SQL server is purposefully installed it should be immediately
disabled until such time as all patches and hot fixes have been applied and
hardening has been completed.
2. Patching the MS SQL server
Patches (service packs and hot fixes) for MS SQL server can be found using
the MBSA tool discussed earlier. All outstanding patches must be applied as
soon as possible and no MS SQL server should be made available until all
patches have been applied. The MBSA tool will detect several security
problems that might otherwise be overlooked and should be immediately
investigated.
– See the Microsoft Network Security Hot Fix Checker (Hfnetchk.exe) Tool
(Q303215) mentioned previously.
– See also the Frequently Asked Questions about the Microsoft Network
Security Hot Fix Checker (Hfnetchk.exe) Tool (Q305385)
The referenced patches are all available from Microsoft Security Bulletins
available on the Microsoft Technet Web site.
Penetration tests
Many security vendors provide free tools to evaluate IT systems (and they do, at
the same time, encourage you to buy their product). These vendors check how
well the IT system being tested has been hardened with the help of a
“penetration test.”
For example, Symantec, makers of Norton Anti-Virus, offers “Symantec Security
Check,” where it’s possible to find some very good free services. These can be
found at the following URL:
http://security.symantec.com/ssc/home.asp
The free services provided include a “Scan for Security Risks” (that is, a
penetration test), a “Scan for Viruses” (very much like the Norton Anti-Virus tool)
and a tool to “Trace a Potential Attacker” (given an IP number). These tools are
all very competent at what they do.
Chapter 9. Server hardening 385