Improving Web Application Security: Threats and - CGISecurity

102 Part II:Designing Secure Web ApplicationsDoes the Network Provide Secure Communication?Your data is at its most vulnerable while in transit between a client and server, orserver to server. How private should the data be? Are you legally responsible forcustomer data?While your application is responsible for handling and transforming data securelyprior to transit, the network is responsible for the integrity and privacy of the data asit transmits. Use an appropriate encryption algorithm when the data must remainprivate. Additionally, make sure that your network devices are secured because theymaintain network integrity.Does Your Deployment Topology Include an Internal Firewall?If an internal firewall separates your Web server from an application server or adatabase server, review the following questions to ensure that your designaccommodates this:● How do downstream servers authenticate the Web server?If you use domain accounts and Windows authentication, does the firewall openthe necessary ports? If not, or if the Web server and downstream server are inseparate domains, you can use mirrored local accounts. For example, you canduplicate the least privileged local ASPNET account that is used to run the Webapplication on the database server.● Do you use distributed transactions?If the Web server initiates distributed transactions using the services of theMicrosoft Distributed Transaction Coordinator (DTC), does the internal firewallopen the necessary ports for DTC communication?For more information about using the DTC through a firewall, see MicrosoftKnowledge Base article 250367, “INFO: Configuring Microsoft DistributedTransaction Coordinator (DTC) to Work Through a Firewall.”Does Your Deployment Topology Include a Remote Application Server?If your deployment topology includes a physically remote middle tier, review thefollowing questions:● Do you use Enterprise Services?If so, have you restricted the DCOM port range and does any internal firewallopen these ports?Note In some scenarios, using a middle-tier Web service as a front end to the EnterpriseServices application is a superior design choice. With this approach, the Web server cancommunicate with the application server through port 80 using Simple Object AccessProtocol (SOAP).