Enterprise Library Test Guide - Willy .Net

124
Enterprise Library Test Guide
Establishing the Security Requirements
The security requirements for the Enterprise Library focus on maintaining the confidentiality
of the data, the integrity of the data, and the availability of the application
blocks. In general, maintaining availability meant preventing denial of service
attacks. Here are the Enterprise Library security requirements:
●
●
●
●
●
●
Ensure that an attacker cannot read confidential information, such as a connection
string, in the configuration files.
Ensure that an attacker cannot read confidential information in the log message
repositories, such as a database, event log, or flat file.
Ensure that an attacker cannot alter information in the log message repositories.
Ensure that an attacker cannot tamper with the configuration files.
Ensure that an attacker cannot tamper with or replace the assemblies.
Ensure that an attacker cannot launch denial of service attacks.
These requirements form the basis for the rest of the security review. To make these
general requirements more specific requires a thorough understanding of how the
application block works.
Analyzing the Logging Application Block
Analyzing the Logging Application Block means identifying its assets, dependencies,
and subsystems. Use the security requirements as a guideline for identifying the relevant
components. It is also important to identify the underlying assumptions about
security that were made when the application block was first designed.
To analyze the application block, you should:
●
●
●
●
●
●
●
Identify the assets.
Create an architectural drawing.
Identify the entry points.
Identify the relevant classes.
Identify the external dependencies.
Identify the assumptions.
Identify any other information that might affect the application block's security.
Identifying the Assets
Assets are resources that need to be protected from an attack. Table 1 lists the
Logging Application Block’s assets.