Improving Web Application Security: Threats and - CGISecurity

Contents xixChapter 11Building Secure Serviced Components 299In This Chapter ....................................................................................................... 299Overview ................................................................................................................ 299How to Use This Chapter ......................................................................................... 300Threats and Countermeasures ................................................................................. 300Network Eavesdropping ....................................................................................... 301Unauthorized Access........................................................................................... 301Unconstrained Delegation.................................................................................... 301Disclosure of Configuration Data .......................................................................... 302Repudiation........................................................................................................ 302Design Considerations ............................................................................................ 302Role-Based Authorization ..................................................................................... 302Sensitive Data Protection .................................................................................... 302Audit Requirements............................................................................................. 303Application Activation Type................................................................................... 303Transactions....................................................................................................... 303Code Access Security.......................................................................................... 303Authentication ........................................................................................................ 304Use (At Least) Call Level Authentication................................................................ 304Authorization .......................................................................................................... 304Enable Role-Based Security ................................................................................. 304Enable Component Level Access Checks .............................................................. 305Enforce Component Level Access Checks ............................................................. 305Configuration Management...................................................................................... 305Use Least Privileged Run-As Accounts .................................................................. 306Avoid Storing Secrets in Object Constructor Strings ............................................... 306Avoid Unconstrained Delegation ........................................................................... 306Sensitive Data ........................................................................................................ 307Auditing and Logging ............................................................................................... 308Audit User Transactions....................................................................................... 308Building a Secure Serviced Component .................................................................... 309Assembly Implementation.................................................................................... 310Serviced Component Class Implementation .......................................................... 311Code Access Security Considerations ....................................................................... 313Deployment Considerations ..................................................................................... 314Firewall Restrictions ............................................................................................ 314Summary ............................................................................................................... 316Additional Resources .............................................................................................. 317Chapter 12Building Secure Web Services 319In This Chapter ....................................................................................................... 319Overview ................................................................................................................ 319How to Use This Chapter ......................................................................................... 320