Improving Web Application Security: Threats and - CGISecurity

108 Part II:Designing Secure Web ApplicationsTable 5.2 Common Authentication Vulnerabilities (continued)VulnerabilityImplicationsOver-privileged accounts The risks associated with a process or account compromiseincrease.Long sessionsMixing personalization withauthenticationThe risks associated with session hijacking increase.Personalization data is suited to persistent cookies.Authentication cookies should not be persisted.Review the following questions to identify potential vulnerabilities in the way yourapplication performs authentication:● Do you separate public and restricted access?● Have you identified service account requirements?● How do you authenticate the caller?● How do you authenticate with the database?● Do you enforce strong account management practices?Do You Separate Public and Restricted Access?If your application provides public areas that do not require authentication andrestricted areas that do require authentication, examine how your site designdistinguishes between the two. You should use separate subfolders for restrictedpages and resources and then secure those folders in Internet Information Services(IIS) by configuring them to require SSL. This approach allows you to providesecurity for sensitive data and authentication cookies using SSL in only those areas ofyour site that need it. You avoid the added performance hit associated with SSLacross the whole site.Have You Identified Service Account Requirements?Your design should identify the range of service accounts that is required to connectto different resources, including databases, directory services, and other types ofremote network resources. Make sure that the design does not require a single, highlyprivileged account with sufficient privileges to connect to the range of differentresource types.● Does the design require least privileged accounts?Have you identified which resources and operations require which privileges?Check that the design identifies precisely which privileges each account requiresto perform its specific function and use least privileged accounts in all cases.●Does the application need to maintain service account credentials?If so make sure that the credentials are encrypted and held in a restricted location,such as a registry key with a restricted access control list (ACL).