Improving Web Application Security: Threats and - CGISecurity

34 Part I: Introduction to Threats and CountermeasuresUnauthorized Access to Configuration StoresBecause of the sensitive nature of the data maintained in configuration stores, youshould ensure that the stores are adequately secured.Countermeasures to protect configuration stores include:● Configure restricted ACLs on text-based configuration files such asMachine.config and Web.config.● Keep custom configuration stores outside of the Web space. This removes thepotential to download Web server configurations to exploit their vulnerabilities.Retrieval of Plaintext Configuration SecretsRestricting access to the configuration store is a must. As an important defense indepth mechanism, you should encrypt sensitive data such as passwords andconnection strings. This helps prevent external attackers from obtaining sensitiveconfiguration data. It also prevents rogue administrators and internal employeesfrom obtaining sensitive details such as database connection strings and accountcredentials that might allow them to gain access to other systems.Lack of Individual AccountabilityLack of auditing and logging of changes made to configuration information threatensthe ability to identify when changes were made and who made those changes. Whena breaking change is made either by an honest operator error or by a maliciouschange to grant privileged access, action must first be taken to correct the change.Then apply preventive measures to prevent breaking changes to be introduced in thesame manner. Keep in mind that auditing and logging can be circumvented by ashared account; this applies to both administrative and user/application/serviceaccounts. Administrative accounts must not be shared. User/application/serviceaccounts must be assigned at a level that allows the identification of a single source ofaccess using the account, and that contains any damage to the privileges granted thataccount.Over-privileged Application and Service AccountsIf application and service accounts are granted access to change configurationinformation on the system, they may be manipulated to do so by an attacker. The riskof this threat can be mitigated by adopting a policy of using least privileged serviceand application accounts. Be wary of granting accounts the ability to modify theirown configuration information unless explicitly required by design.