Improving Web Application Security: Threats and - CGISecurity

384 Part III: Building Secure Web ApplicationsConfiguration ManagementDatabase connection strings are the main configuration management concern for dataaccess code. Carefully consider where these strings are stored and how they aresecured, particularly if they include credentials. To improve your encryptionmanagement security:● Use Windows authentication.●●Secure your connection strings.Secure UDL files with restricted ACLs.Use Window AuthenticationWhen you use Windows authentication, the credentials are managed for you and thecredentials are not transmitted over the network. You also avoid embedding usernames and passwords in connection strings.Secure Your Connection StringsIf you need to use SQL authentication, then your connection contains the user nameand password. If an attacker exploits a source code disclosure vulnerability on theWeb server or manages to log on to the server, the attacker can retrieve the connectionstrings. Similarly, anyone with a legitimate login to the server can view them. Secureconnection strings using encryption.Encrypt the Connection StringEncrypt connection strings by using DPAPI. With DPAPI encryption, you avoidencryption key management issues because the encryption key is managed by theplatform and is tied to either a specific computer or a Windows user account. To useDPAPI, you must call the Win32 DPAPI functions through P/Invoke.For details on how to build a managed wrapper class, see “How To: Create a DPAPILibrary” in the “How To” section of “Microsoft patterns & practices Volume I, BuildingSecure ASP.NET Applications: Authentication, Authorization, and Secure Communication”at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/secnetlpMSDN.asp.Store Encrypted Connection Strings SecurelyThe encrypted connection string can be placed in the registry or in the Web.config orMachine.config file. If you use a key beneath HKEY_LOCAL_MACHINE, apply thefollowing ACL to the key:Administrators: Full ControlProcess Account: Read