Enterprise Library Test Guide - Willy .Net

Testing for Security Best Practices 131
No.
External
Dependencies Descriptions
8 WMI The Logging Application Block uses WMI to raise
events.
9 Performance
counters
The Logging Application Block uses performance
counters to track its performance.
Data
Direction
Push
Push
Trusted?
Yes
Yes
Identify the Implementation Assumptions
Implementation assumptions are premises about how the application block works.
Implementers describe these assumptions when they write the specification for the
application block and before they begin writing the code. Typically, these assumptions
are reviewed again once the implementation is complete. Table 5 lists the implementation
assumptions about the Logging Application Block. The term “application”
refers to the application that uses the Logging Application Block.
Table 5: Logging Application Block Implementation Assumptions
No. Category Assumptions
1 ACLs for event log The event log’s ACLs protect the log against unauthorized users and
processes.
2 Database access
privileges
3 Message queuing
access privileges
4 File system
privileges
5 SMTP server
privileges
The application has the appropriate privileges to access the database.
The application has the appropriate privileges to access the message
queues.
The application has the appropriate privileges to access the file
system.
The application has the appropriate privileges to use the SMTP
server to send e-mail messages.
6 WMI privileges The application has the appropriate privileges to raise WMI events.
7 The application
that uses the Data
Access Application
Block to log
messages to a
database
8 Other subsystems
and application
blocks
9 Performance
counters
The application can identify and authorize the Data Access Application
Block. In this case, “identify” means that the application can
trust the Data Access Application Block assemblies. Authorization
means that the application has the correct SQL Server permissions
to allow the appropriate groups of users to read and write to the
database.
The Logging Application Block is dependent on the Enterprise
Library Core for configuration information and the Data Access
Application Block to use the Database Trace Listener. The Logging
Application Block must ensure that it uses the correct Enterprise
Library Core assemblies for configuration and the correct Data Access
Application Block assemblies to log messages to a database.
The Logging Application Block requires the necessary read and
write access permissions to use the performance counters.
continued