Enterprise Library Test Guide - Willy .Net

132
Enterprise Library Test Guide
Identify Any Additional Security Notes
Additional security notes are other threats or information that are not covered elsewhere.
Table 6 lists the Logging Application Block additional security notes.
Table 6: Logging Application Block Additional Security Notes
No. Notes
1 The configuration file or the custom configuration store should be protected by ACLs or, if
possible, encrypted.
2 The application must have the proper ACLs and privileges to log messages to different
resources such as the event log, a database, a message queue, an SMTP server, and the
file system. The application must also have the correct ACLs and privileges to raise WMI
events.
3 Log messages that contain sensitive information should be protected by ACLs or else
encrypted.
4 Log messages should be encrypted when sent over a network.
Building the Threat Models
After you have analyzed the application block, you can build the threat models.
Threat models identify threats against specific resources, assets, and trust boundaries,
pinpoint vulnerabilities, and provide countermeasures. Each table contains a STRIDE
classification. STRIDE is the acronym used at Microsoft to categorize different threat
types. STRIDE stands for Spoofing, Tampering, Repudiation, Information disclosure,
Denial of service, and Elevation of privilege. To learn more about STRIDE see Threats
and Countermeasures in Improving Web Application Security: Threats and Countermeasures
on MSDN.
A DREAD table follows each threat model. DREAD stands for Damage potential,
Reproducibility, Exploitability, Affected users, and Discoverability. In DREAD, you
assign each of these categories a number that rates the potential risk it poses to your
application. To learn more about DREAD, see Threat Modeling in Improving Web Application
Security: Threats and Countermeasures on MSDN.
Table 7 lists details about threat 1.
Table 7: Logging Application Block Threat 1
Threat 1
Name
Entry points
Threat
description
Logging Application Block assemblies are not strong named.
Tampering with assemblies
Assemblies
The Logging Application Block assemblies are not strong named.