Improving Web Application Security: Threats and - CGISecurity

316 Part III: Building Secure Web ApplicationsSummaryDTC RequirementsIf your application uses COM+ distributed transactions and these are used acrossremote servers separated by an internal firewall, then the firewall must open thenecessary ports to support DTC traffic.If your deployment architecture includes a remote application tier, transactions areusually initiated within the Enterprise Services application and propagated to thedatabase server. In the absence of an application server, the Enterprise Servicesapplication on the Web server initiates the transaction and propagates it to the SQLServer resource manager.For information about configuring firewalls to support DTC traffic, see Chapter 18,“Securing Your Database Server.”Enterprise Services (COM+) security relies on Windows security to authenticate andauthorize callers. Authorization is configured and controlled with COM+ roles thatcontain Windows group or user accounts. The majority of threats that relate toEnterprise Services applications and serviced components can be addressed withsolid coding techniques, and appropriate catalog configuration.The developer should use declarative attributes to set the serviced componentsecurity configuration. These attributes determine how the application is configuredwhen it is initially registered with Enterprise Services (typically using Regsvcs.exe).Not every security configuration setting can be set with attributes. An administratormust specify the run-as identity for a server application. The administrator must alsopopulate roles with Windows group or user accounts at deployment time.When you are developing serviced components or are evaluating the security of yourEnterprise Security solution, use “Checklist: Securing Enterprise Services” in the“Checklists” section of this guide.