Disable potentially harmful SQL stored procedure calls

Deny extended URLs

Implement specific approaches to secure dynamic Web content

Install and run authorized Microsoft SQL Server and IIS services under a nonprivileged account

Apply the principle of "least privilege" on SQL machine accounts

Require passwords on Microsoft SQL Server administrator, user, and machine accounts

Lock out accounts on your mainframes after multiple unsuccessful logon attempts

Run the minimum required applications and services on servers needed to perform their intended function

Deny access to the Internet except through proxies for store and enterprise servers and workstations

Implement firewall rules to block or restrict Internet and intranet access for database systems

Implement firewall rules to block known malicious IP addresses

Ensure that your systems that verify and generate PIN numbers, for instance, do not respond to commands that generate encrypted PIN blocks