Main requirements to secure my Application in any database related features

Question

I have an application which is hosted on a windows server on which an SQL DB exists. This server communicates with the clients and agents installed on host PCs through TCP/IP and SSL connections. I'm currently focusing on any security features related to the Database. What are the main requirements needed to be able to achieve a secured environment on the database level. The top factors i could think of are the following :

1. Account used by the application to access the database (least privileged user account).
2. Encrypted database.
3. Control the access rights on the database.
4. Data in the database should be hashed.
5. Control the access rights on the server.

Answer 1

In addition to what you have already listed, you should validate all the data passed to the database. Unvalidated input can lead to persistent cross-site scripting or SQL injection.

How to validate input passed to database:

• Identify application inputs
• Identify database entry points
• Create and use validators
• Use Type-Safe parameters in SQL statements (Stored procedures and Parameterized queries)

---

Logging and monitoring is another improvement. You can take action in case of any abnormal behaviour. For instance you can apply a set of rules to respond when your application makes a suspicious behaviour.There are tools/products which montiros database activity and protects them with a set of preconfigured defenses, and helps you build a custom security policy for your environment. You can search the web if you don't want to build yourself.

Additionally, you can use a host-based intrusion detection system such as OSSEC for log analysis, file integrity checking, policy monitoring, real-time alerting and active response.

Answer 2

If you can, a best practice is to handle all database logic with Stored Procedures and grant the account that accesses the database access to only the stored procedures, this will help prevent a hacker that gains access to the application from directly accessing tables. Moving business logic to stored procedures can also improve performance if it reduces the number of calls the application has to make to the database. Never use dynamic sql, again, that opens you up to SQL injection and also hurts performance because it doesn't take advantage of cached query plans. It's also a best practice to encrypt your stored procedures.