Improving Web Application Security: Threats and - CGISecurity

110 Part II:Designing Secure Web Applications●●●●●Do you use the process account?If you use the process account of the application and connect to SQL Server usingWindows authentication, make sure that your design assumes a least privilegedaccount. The local ASPNET account is provided for this purpose, although withlocal accounts, you need to create a duplicate account on the database server.If you plan to use a domain account, make sure that it is a least privileged accountand check that all intervening firewalls support Windows authentication byopening the relevant ports.Do you use service accounts?If your design requires multiple identities to support more granular authorizationin the database, examine how you plan to store the account credentials (ideallythey are encrypted using the Data Protection API (DPAPI) and held in a securedregistry key) and how you are going to use the service identity.Also examine which process will be used to create the impersonated securitycontext using the service account. This should not be done by the ASP.NETapplication process on Microsoft Windows 2000 because it forces you to increasethe privileges of the process account and grant the “Act as part of the operationsystem” privilege. This should be avoided because it significantly increases therisk factor.Have you considered using the anonymous Internet user identity?For applications that use Forms or Passport authentication, you can configure aseparate anonymous user account for each application. Next, you can enableimpersonation and then use the anonymous identity to access the database. Thisapproach accommodates separate authorization and identity tracking for separateapplications on the same Web server.Do you use the original user identity?If your design requires impersonation of the original caller, you need to considerwhether or not the approach provides sufficient scalability because connectionpooling is ineffective. An alternative approach is to flow the identity of theoriginal caller at the application level through trusted query parameters.How do you store database connection strings?If database connection strings are hard coded or stored in clear text inconfiguration files or the COM+ catalog, it makes them vulnerable. Instead, youshould encrypt them and restrict access to the encrypted data.For more information about the different options for connecting to SQL Server andabout storing database connection strings securely, see Chapter 14, “Building SecureData Access.”