Improving Web Application Security: Threats and - CGISecurity

476 Part IV: Securing Your Network, Host, and ApplicationPerimeterFirewallEnterprise ServicesWeb Services.NET RemotingClientWeb ServerApplicationServerSQLServerOptional InternalFirewallsFigure 17.1Remote application server deployment modelBefore delving into technology-specific configuration, the chapter identifies the mainthreats to an application server. These threats are somewhat different from those thatapply to an Internet-facing Web server because middle-tier application servers are (orshould be) isolated from direct Internet access.To secure the application server, you must apply an incremental securityconfiguration after the underlying operating system and Internet InformationServices (IIS) Web server (if installed) have been locked down.How to Use This ChapterThis chapter focuses on the application server and the associated communicationchannels that connect the Web server to the application server and the applicationserver to the database server.To get the most out of this chapter:● Read Chapter 2, “Threats and Countermeasures.” This will give you a betterunderstanding of potential threats to Web applications.● Use the companion securing chapters. The current chapter is part of a securingsolution that includes chapters that cover host (operating system) and networklayer security. Use the following chapters in tandem with this one:●●●Chapter 15, “Securing Your Network”Chapter 16, “Securing Your Web Server”Chapter 18, “Securing Your Database Server”