SECURITY SQL SERVER PROCEDURE:

SQL SERVER DATABASE SHOULD A NEW USER TO ACCESS SQL SERVER DATABASE EACH SQL SERVER DATABASE SHOULD HAVE A NEW LOGIN. EACH LOGIN SHOULD HAVE RELATED TO DATABASE NAMES EACH LOGIN SHOULD HAVE A COMPLEX SQL SERVER PASSWORD PASSWORD SHOULD BE VERY COMPLEX AND PRIOR WITHIN POLICY REQUEST Use complex passwords for sa and SQL Server-specific logins

SQL LOGIN SHOULD HAVE 3 OPTIONS

ENFORCE PASSWORD POLICY ENFORCE PASSWORD EXPIRATION USER MUST CHANGE PASSWORD AT NEXT LOGIN

NOTE: BEST WAY WE CAN USE 1 OPTION FOR SECUIRTY REASONS

IF WE KEEP ENFORCE PASSWORD EXPIRATION IT WILL EXPIRES THE PASSWORD. DEFAULT DATABASE SHOULD BE MASTER BECAUSE ALL DATA SHOULD BE STORED IN

MASTER DATABASE. PUBLIC IS ALREADY ASSIGNED AUTOMATICALLY TO ALL DATABASE LOGINS USER MAPPING SHOULD BE DONE ON DATABASE ACCES TO WHICH DATABASE IT

SHOULD BE USED. DATABASE USER MAPPING DATABASE SHOULD HAVE ONLY READ & WRITE

PERMISSIONS. USER REQUESTS TO GIVE PERMISSIONS JUST GIVE DB_OWNER, IF ACCESS DATABASE

FULL RIGHTS FOR THAT OWNER. NOTE: NEVER GIVE ANY SYSADMIN PERMISSIONS TO ANY USER. NO SPECIFIC PERMISSIONS SHOULD NOT BE GIVEN USER. STATUS SHOULD BE GRANT AND ENABLED ON SQL SERVER STAUS OPTION.

BEFORE RUNNING SQL SERVER SETUP

BEFORE YOU RUN THE SQL SERVER SETUP PROGRAM, CHECK THE FOLLOWING ITEMS:

CREATE A LEAST PRIVILEGED LOCAL ACCOUNT WITH WHICH TO RUN THE SQL SERVER SERVICE. USE THIS ACCOUNT WHEN YOU ARE PROMPTED FOR SERVICE SETTINGS DURING SETUP. DO NOT USE THE LOCAL SYSTEM ACCOUNT OR AN ADMINISTRATOR ACCOUNT.

MAKE SURE YOU DO NOT INSTALL SQL SERVER ON A DOMAIN CONTROLLER. MAKE SURE YOU INSTALL SQL SERVER ON A PARTITION FORMATTED WITH NTFS. INSTALL SQL SERVER PROGRAM AND DATABASE FILES ON A NON-SYSTEM VOLUME,

SEPARATE FROM THE OPERATING SYSTEM. EXISTING DOMAIN AND LOCAL SECURITY POLICIES CAN BE USED TO ENFORCE STRONG

PASSWORDS AND ACCOUNT MANAGEMENT BEST PRACTICES. CREDENTIALS ARE NOT PASSED OVER THE NETWORK. APPLICATION DATABASE CONNECTION STRINGS DO NOT REQUIRE CREDENTIALS. CHECK COLLATION SETTTING BEFORE INSTALLATION OF SQL SERVER. USE WINDOWS AUTHENTICATION MODE FOR BEST PRACTICES---BOTH FAILED AND

SUCCESSFUL LOGINS.

Restrict SQL Server to TCP/IP IN THE MICROSOFT SQL SERVER PROGRAMS GROUP, START THE SERVER NETWORK UTILITY. MAKE SURE THAT TCP/IP IS THE ONLY SQL SERVER PROTOCOL THAT IS ENABLED AS SHOWN.

Restrict Access to the SQL Server Port

USE A PERIMETER FIREWALL TO PREVENT DIRECT ACCESS FROM THE INTERNET TO THE SQL SERVER PORTS — BY DEFAULT, TCP PORT 1433 AND UDP PORT 1434. CONFIGURE IPSEC POLICIES TO LIMIT ACCESS, THROUGH TCP PORT 1433 AND UDP PORT 1434, FROM WEB OR APPLICATION SERVERS THAT CONNECT TO THE DATABASE.

HOW TO CREATE A USER ON SQL SERVER DATABASE:

1. OPEN SQL SERVER MANAGEMENT STUDIO (SSMS) FROM ALL PROGRAM

2. SQL SERVER MANAGEMENT STUDIO OPENED ----CLICK ON CONNECT

3. CLICK ON SECURITY TAB HAS SHOWN BELOW

4. SECURITY--LOGIN

5. SECURITY--LOGIN----NEW LOGIN

6. CLICK ON NEW LOGIN WINDOW IT OPENS IN NEW WINDOW

7. CLICK ON LOGIN NAME WHICH YOU USED TO CREATE A NEW LOGIN FOR USER ON SQL SERVER

8. GIVE A LOGIN NAME AND PASSWORD SHOULD BE COMPLEX

9. USER MAPPING-SELECT DATABASE-READ\WRITE PERMISSIONS

10. IF USER ASKS DB FULL PERMISSIONS THEN SET DB_OWNER

11. DATABASE SHOULD BE GRANT AND ENABLED