I have an application which is hosted on a windows server on which an SQL DB exists. This server communicates with the clients and agents installed on host PCs through TCP/IP and SSL connections. I'm currently focusing on any security features related to the Database. What are the main requirements needed to be able to achieve a secured environment on the database level. The top factors i could think of are the following :
- Account used by the application to access the database (least privileged user account).
- Encrypted database.
- Control the access rights on the database.
- Data in the database should be hashed.
- Control the access rights on the server.