Enterprise Library Test Guide - Willy .Net

126
Enterprise Library Test Guide
Assets
WMI events
System files
System resources
Vulnerabilities
The Logging Application Block exposes interfaces that allow you
to raise instrumentation events. By providing this access, the
application block exposes system resources, such as flat files, a
SQL Server database, message queues, and the event log, through
WMI (Windows Management Instrumentation) events. You should
prevent unauthorized users from being able to raise instrumentation
events.
The Logging Application Block exposes interfaces that allow you
to log messages to a log file. Information in the configuration file
determines the location of that file. By changing this location,
malicious users can modify or overwrite system files. You should
protect this location from unauthorized read/write operations.
The Logging Application Block exposes interfaces that allow you to
extend the application block. For example, you can add a custom
log handler. Malicious users can use these extensions to expose
system resources that can then be used by an unauthorized application.
Create an Architectural Diagram
A diagram is often helpful in understanding the architecture of a system. Figure 1 is
a diagram of the Logging Application Block. The drawing shows the major subsystems
that are of concern during a security review. For example, the diagram does not
show the trace listener classes because they are trusted components. It does show the
custom trace listener classes because custom code may not be trusted.