CertiGuide to Security+  9  Chapter 3:  Infrastructure Security (Domain 3.0; 20%)

3.5.3.9.2  Databases 1 2 3 4 5 6 7 8 9 10 3.7  Success Questions

Hardening Data Repositories

You also looked at hardening different types of data repositories, which are locations holding information about your network or your organization’s business. Some of these include:

• Directory services, often using LDAP over port 389. It is frequently a good idea to run LDAP over TLS to provide encrypted communication so that information about your network setup or individuals within the organization is not sent across the network in cleartext; you might also restrict access to certain types of directory information by user or group if your directory server allows it; another step to take is to verify that the directory server contains good data to begin with, so that it is not serving up bogus information to clients.
  
  
• Databases, which are collections of information, generally about the company’s products, customers, suppliers, etc. which are generally very sensitive; they are known for having security issues regularly, so keep on top of updates offered by your vendors, and investigate vendor-provided and user community developed recommendations for hardening your databases of choice; watch out for applications which are vulnerable to SQL injection attacks; work with your DBA to restrict access to individual data elements so that they are available only to those with a “need to know”; make sure that your routers and firewalls are configured to only allow connections to your database server’s ports (TCP ports 1433 and 1434 for SQL Server) from those trusted machines which require access and deny access to the database server from other hosts; finally, remove any default passwords your database server may have installed, and if possible select an authentication mechanism that does not rely on passwords, particularly if it requires that the passwords be passed over the net in clear text; if not possible to avoid passwords entirely, make sure you assign strong passwords and change them regularly.

3.5.3.9.2  Databases 1 2 3 4 5 6 7 8 9 10 3.7  Success Questions