SQL Server Security

Here is the list of SQL Server security issue that you must know in your project, please read this basic point carefully and implement in your project for making a secure website.
a) SQL Injection security

1. Input data must be in correct format.
2. We must use stored procedure in our database, if we are not using stored procedure then we must safe parameter of SQL commands
3. We must use four stored procedure for a table insert, update, delete and read.

b) Authentication

1. The “sa” account or other privileged accounts that are members of the “sysadmin” or “db_owner” roles are not used for application logins.
2. Strong password required for authentication.
3. Connection string must be encrypted and must be stored in a secure location

c) Authorization

1. We must use business logic layer or tire architecture in our application for security purpose.
2. For multiple queries we must use commit and rollback transaction.

e) Configuration management

1. Windows authentication is used to avoid credential management.

f) Sensitive Data

1. Security of sensitive data in necessary that include password and other things.

g) Error Handling

1. Proper error handing is necessary in the stored procedure.

For more security detail please knock MSDN.

ASP.NET Basic Security

ASP.NET Basic security we will implement in our website.Every one want to know about security issue in ASP.NET web application, here I am showing basic security that you must know before working any website.
I am going to filter this point according to priority basic.
a) Design Issue

1. Proper validation for numeric, alphanumeric, date time, maximum length and other search filed.
2. Absolute URLs must be used.
3. Our all input parameter will be validated.
4. Query strings with server secrets are hashed.
5. Required filed required, if field are necessary in database. There must be a proper treatment of null values.
6. Web control user control

b) Coding part

1. Documentation of session and view state is necessary for using in near future.
2. SQL parameters are used in data access code to validate length and type of data and to help prevent SQL injection.
3. Passwords are not being stored in the session directly
4. Strong password policies are implemented for authentication.
5. Connection strings are encrypted by using Aspnet_setreg.exe.
6. Proper error handling is necessary.
7. Proper try catch block necessary, not necessary to every where.
8. View state is protected using message authentication codes (MACs).

c) Data Store

1. We will not store our sensitive data in cookies, hidden form fields, or query strings.
2. Session and view state object must be use in proper format, NULL value checking is necessary

d) Before Publish part

1. Compilation debug=false at sever side.
2. We need to set a default, page in the IIS.
3. For IIS Web permissions are configured. Bin directory does not have Read, Write, or Directory browsing permissions. Execute permissions are set to none. Authentication settings are removed (so that all access is denied).
4. Proper read write permission required according to the users.
5. Error handling page required, Generic error pages with harmless messages are returned to the client.

If you want to know detail security detail of ASP.NET then please knock MSDN