Enterprise Library Test Guide - Willy .Net

156
Enterprise Library Test Guide
Design and Deployment Checklist
Table 44 lists the design and deployment recommendations.
Table 44: Design and Deployment Checklist
Check
Yes
Yes
Yes
Yes
Yes
No
Yes
Yes
Yes
Yes
Yes
Yes
Yes
Description
The design should address the scalability and performance criteria. Performance tests
and stress tests demonstrate that the application block meets these criteria. The application
block’s availability and ability to handle concurrent users should also be tested.
Identify precautions that must be taken to satisfy the security requirements of the
infrastructure and network (examples include operating system services, communication
protocols, and firewalls). For example, the Logging Application Block should use a
secure channel such as SSL or IPSEC, if it is logging sensitive data to a remote SQL
Server or a remote message queue. The Caching Application Block does not encrypt
data, so sensitive data logged to SQL store should be used over secured channel.
Application blocks do not save sensitive data in the registry or in text files during installation.
The application block respects the principle of least privilege. An application block does
not need permissions from an administrator to run on ASP.NET, which requires only a
network service account, or in Windows-based applications, which accepts any standard
security context with the appropriate permissions to write to resources such as the
event log and to use message queuing. The exact permissions depend on the application
block.
Secure configuration stores with the appropriate ACLs.
Do not store sensitive information in plain text configuration files. An example of such
information is a connection string that is used by the Data Access Application Block.
Users should encrypt the configuration file. For more information, see Configuring the
Application Blocks in the Enterprise Library documentation.
The design identifies application trust boundaries.
The design identifies the identities that are used to access resources across the trust
boundaries.
The design identifies service account requirements.
The design identifies the mechanisms, such as SSL, IPSec, and encryption, to protect
credentials when they are sent over a network.
If SQL authentication is used, credentials are adequately secured over the network (with
SSL or IPSec) and in storage (with DPAPI).
The application blocks do not change the ACLs of the registry or of any files during
installation or run time.
The application blocks do not listen to unknown ports except for their internal use. An
example of where this is acceptable is when the Logging Application Block uses the
MSMQ Trace Listener.