ADO.NET 1.1 Security Guidelines

From Guidance Share

- J.D. Meier, Alex Mackman, Michael Dunner, Srinath Vasireddy, Ray Escamilla and Anandha Murukan

Contents 1 Design Guidelines 2 Authentication 3 Authorization 4 Configuration Management 5 Exception Management 6 Input Validation 7 Sensitive Data 8 Deployment Considerations 9 References

Design Guidelines

• Use Windows authentication.
• Use least privileged accounts.
• Use stored procedures.
• Protect sensitive data in storage.
• Use separate data access assemblies.

Authentication

• Use Windows authentication.
• Protect the credentials for SQL authentication.
• Connect using a least privileged account.

Authorization

• Restrict unauthorized callers.
• Restrict unauthorized code.
• Restrict the application in the database.

Configuration Management

• Use Windows authentication.
• Secure your connection strings.
• Secure UDL files with restricted ACLs.

Exception Management

• Trap and log ADO.NET exceptions.
• Ensure database connections are always closed.
• Use a generic error page in your ASP.NET applications.

Input Validation

• Constrain input.
• Use type safe SQL parameters.
• Use Parameter Batching.
• Use Escape Routines.

Sensitive Data

• Encrypt sensitive data if you need to store it.
• Secure sensitive data over the network.
• Store password hashes with salt.

Deployment Considerations

• Firewall restrictions.
• Connection string management.
• Login account configuration.
• Logon auditing.
• Data privacy and integrity on the network.

References

• See Building Secure Data Access at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/THCMCh14.asp