First published on TECHNET on Oct 15, 2012
We harden SQL Server to minimize the threats to SQL Server from rouges/hackers and crackers, but it may be equally important to harden systems other than SQL Server to protect our data. For example, coders and DBA's need to ensure that calls to SQL Server are protected from SQL Injection attacks. Another valuable tactic is to prevent bad guys from finding the servers with SQL Server on them, and we can help guard against that by disabling NetBIOS and Small Message Blocks (SMB) on Internet-connected servers that don't need them.
The Database STIG makes clear that any unnecessary network protocols should be disabled on the server hosting an instance of SQL Sever, but what I'm pointing out in this post is that network protocols on other servers may also need to be secured to provide maximum security for SQL Server.
If you have a web server or DNS server exposed to the Internet, as is very common, they normally don't need NetBIOS or SMB. If they're enabled and a cracker compromises one of them, they may be able to use them to find instances of SQL Server. The MSDN article "Security Considerations for a SQL Server Installation" (
http://msdn.microsoft.com/en-us/library/ms144228(v=sql.105).aspx
) covers this issue, among others.
If you want to harden your web servers and DNS servers, here are links to articles descibing how to disable NetBIOS and SMB. Note that in Device Manager, you may have an entry of "NETBT" instead of "NetBios over TCP/IP" (both represent netbt.sys).
How to Disable NetBIOS
(Netbt.sys)
http://msdn.microsoft.com/en-us/library/ms143696(v=SQL.90).aspx
How to Disable SMB
http://msdn.microsoft.com/en-US/library/ms143455(v=sql.90).aspx
