Improving Web Application Security: Threats and - CGISecurity

Contents xxiChapter 13Building Secure Remoted Components 347In This Chapter ....................................................................................................... 347Overview ................................................................................................................ 347How to Use This Chapter ......................................................................................... 348Threats and Countermeasures ................................................................................. 349Unauthorized Access........................................................................................... 349Network Eavesdropping ....................................................................................... 350Parameter Manipulation ...................................................................................... 351Serialization ....................................................................................................... 351Design Considerations ............................................................................................ 352Do Not Expose Remoted Objects to the Internet.................................................... 352Use the HttpChannel to Take Advantage of ASP.NET Security ................................. 352Use the TcpChannel Only in Trusted Server Scenarios............................................ 352Input Validation....................................................................................................... 354Serialization Attacks............................................................................................ 354MarshalByRefObject Attacks ................................................................................ 354Authentication ........................................................................................................ 355ASP.NET Hosting................................................................................................. 355Custom Process Hosting ..................................................................................... 358Authorization .......................................................................................................... 359Use IPSec for Machine Level Access Control......................................................... 359Enable File Authorization for User Access Control .................................................. 359Authorize Users with Principal-Based Role Checks ................................................. 360Consider Limiting Remote Access ........................................................................ 360Sensitive Data ........................................................................................................ 361Using IPSec........................................................................................................ 361Using SSL .......................................................................................................... 361Using a Custom Encryption Sink........................................................................... 361Denial of Service .................................................................................................... 364Exception Management ........................................................................................... 364Using a Custom Channel Sink.............................................................................. 365Auditing and Logging ............................................................................................... 365Using a Custom Channel Sink.............................................................................. 365Code Access Security (CAS) Considerations.............................................................. 365Summary ............................................................................................................... 365Additional Resources .............................................................................................. 366Chapter 14Building Secure Data Access 367In this Chapter........................................................................................................ 367Overview ................................................................................................................ 367How to Use This Chapter ......................................................................................... 368