Privileges & Security

Question

I'm reviewing security on SQL Servers. Trying to get an idea what the gurus are doing for web applications.
Currently:
We use a domain account for web applications access to SQL Server, let's call the username InternetUsr.
For security, we GRANT InternetUsr execute permissions on SPs.
We also explicitly DENY SELECT on the following (in SQL2000)
DENY SELECT ON sysobjects TO
DENY SELECT ON sysindexes TO
DENY SELECT ON syscolumns TO
DENY SELECT ON systypes TO
DENY SELECT ON syscomments TO
DENY SELECT ON sysfiles1 TO
DENY SELECT ON syspermissions TO
DENY SELECT ON sysusers TO
DENY SELECT ON sysproperties TO
DENY SELECT ON sysdepends TO
DENY SELECT ON sysreferences TO
DENY SELECT ON sysfulltextcatalogs TO
DENY SELECT ON sysindexkeys TO
DENY SELECT ON sysforeignkeys TO
DENY SELECT ON sysmembers TO
DENY SELECT ON sysprotects TO
DENY SELECT ON sysfulltextnotify TO
DENY SELECT ON sysfiles TO
DENY SELECT ON sysfilegroups TO
And on SQL2008 I'm planning to explicitly DENY SELECT on
DENY SELECT ON sys.objects TO
DENY SELECT ON sys.indexes TO
DENY SELECT ON sys.columns TO
DENY SELECT ON sys.types TO
DENY SELECT ON sys.sql_modules TO
DENY SELECT ON sys.database_files TO
DENY SELECT ON sys.database_permissions TO
DENY SELECT ON sys.database_principals TO
DENY SELECT ON sys.sql_expression_dependencies TO
DENY SELECT ON sys.foreign_keys TO
DENY SELECT ON sys.fulltext_catalogs TO
DENY SELECT ON sys.index_columns TO
DENY SELECT ON sys.foreign_key_columns TO
DENY SELECT ON sys.database_role_members TO
DENY SELECT ON sys.database_permissions TO
DENY SELECT ON sys.filegroups TO
The reasons are pretty obvious I think. If someone hacks the web server, and got hold of the clear text password on the web.config file, they are not able to do much with that user except execute the SPs.
Question 1: Is that all the sys views or is there more that I should be denying?
Question 2: Is that a good practice from the security standpoint for a web applications service account?

Answer 1

>Question 2: Is that a good practice from the security standpoint for a web applications service account?
No. Generally unnecessary in SQL Server 2005 and later.  From BOL:
"In earlier versions of SQL Server, metadata for all objects in a database is visible to members of the
public role. This means that any user that is logged on to an instance of SQL Server can view metadata for every object in the server, even those objects on which a user has no rights.
In SQL Server 2005 and later, the visibility of metadata is limited to securables that a user either owns or on which the user has been granted some permission. For example, the following query returns a row if the user has been granted a permission such
as SELECT or INSERT on the table myTable."
Metadata Visibility Configuration
David
David http://blogs.msdn.com/b/dbrowne/