Improving Web Application Security: Threats and - CGISecurity

Chapter 4: Design Guidelines for Secure Web Applications 83AuthorizationAuthorization determines what the authenticated identity can do and the resourcesthat can be accessed. Improper or weak authorization leads to information disclosureand data tampering. Defense in depth is the key security principle to apply to yourapplication’s authorization strategy.The following practices improve your Web application’s authorization:● Use multiple gatekeepers.●●Restrict user access to system-level resources.Consider authorization granularity.Use Multiple GatekeepersOn the server side, you can use IP Security Protocol (IPSec) policies to provide hostrestrictions to restrict server-to-server communication. For example, an IPSec policymight restrict any host apart from a nominated Web server from connecting to adatabase server. IIS provides Web permissions and Internet Protocol/ Domain NameSystem (IP/DNS) restrictions. IIS Web permissions apply to all resources requestedover HTTP regardless of the user. They do not provide protection if an attackermanages to log on to the server. For this, NTFS permissions allow you to specify peruser access control lists. Finally, ASP.NET provides URL authorization and Fileauthorization together with principal permission demands. By combining thesegatekeepers you can develop an effective authorization strategy.Restrict User Access to System Level ResourcesSystem level resources include files, folders, registry keys, Active Directory objects,database objects, event logs, and so on. Use Windows Access Control Lists (ACLs) torestrict which users can access what resources and the types of operations that theycan perform. Pay particular attention to anonymous Internet user accounts; lock thesedown with ACLs on resources that explicitly deny access to anonymous users.For more information about locking down anonymous Internet user accounts withWindows ACLs, see Chapter 16, “Securing Your Web Server.”Consider Authorization GranularityThere are three common authorization models, each with varying degrees ofgranularity and scalability.