Improving Web Application Security: Threats and - CGISecurity

Chapter 12: Building Secure Web Services 337Sensitive DataThe threats of network eavesdropping or information disclosure at intermediateapplication nodes must be addressed if your Web service request or responsemessages convey sensitive application data, for example, credit card numbers,employee details, and so on.In a closed environment where you are in control of both endpoints, you can useSSL or IPSec to provide transport layer encryption. In other environments and wheremessages are routed through intermediate application modes, a message levelsolution is required. The WS-Security standard defines a confidentiality service basedon the World Wide Web Consortium (W3C) XML Encryption standard that allowsyou to encrypt some or all of a SOAP message before it is transmitted.XML EncryptionYou can encrypt all or part of a SOAP message in three different ways:● Asymmetric encryption using X.509 certificates● Symmetric encryption using shared keys● Symmetric encryption using custom binary tokensAsymmetric Encryption Using X.509 CertificatesWith this approach, the consumer uses the public key portion of an X.509 certificateto encrypt the SOAP message. This can only be decrypted by the service that ownsthe corresponding private key.The Web service must be able to access the associated private key. By default,WSE searches for X.509 certificates in the local machine store. You can use the configuration element in Web.config to set the store location to the current user storeas follows.If you use the user store, the user profile of the Web service’s process account must beloaded. If you run your Web service using the default ASPNET least privileged localaccount, version 1.1 of the .NET Framework loads the user profile for this account,which makes the user key store accessible.