Improving Web Application Security: Threats and - CGISecurity

314 Part III: Building Secure Web ApplicationsDeployment ConsiderationsEnterprise Services applications are typically installed on the Web server or on aremote application server. Figure 11.3 shows the two typical deployment scenariosfor Enterprise Services. From a security perspective, the notable difference with theremote deployment scenario is that data passed to and from the serviced componentis passed over the network, often through an internal firewall used to separate theinternal and perimeter networks.Web ServerDatabase ServerWebApplicationEnterpriseServicesPerimeterFirewallInternalFirewallWeb ServerApplication ServerDatabase ServerWebApplicationEnterpriseServicesPerimeterFirewallInternalFirewallFigure 11.3Enterprise Services typical deployment configurationsDevelopers and administrators need to be aware of the following deployment-relatedissues:● Firewall restrictions, including port requirements for DCOM and DTC● Run-as account configuration● Storing secrets in object constructor stringsFor more information about applying secure configuration at deployment time,see Chapter 17, “Securing Your Application Server.”Firewall RestrictionsIf the client and Enterprise Services application are separated by an internal firewall,the relevant ports that support DCOM and possibly the DTC (if your application usesdistributed transactions) must be open.