Improving Web Application Security: Threats and - CGISecurity

478 Part IV: Securing Your Network, Host, and Application●●●Lack of transport or application layer encryptionInsecure network-hardware administrative interfacesUse of the .NET Remoting TCP Channel to remote componentsAttacksThe attacker places packet-sniffing tools on the network to capture traffic.CountermeasuresCountermeasures to prevent packet sniffing include the following:●●●●●●Use secure authentication, such as Windows authentication, that does not sendpasswords over the network.Encrypt SQL Server authentication credentials. If you use SQL Serverauthentication, you can encrypt credentials automatically by installing a servercertificate on the database server.Secure communication channels. Options include using Secure Sockets Layer(SSL) or Internet Protocol Security (IPSec).Use remote procedure call (RPC) encryption with Enterprise Services applications.Use a segmented network, which can isolate eavesdropping to compromisedsegments.Use the HttpChannel and SSL with .NET Remoting.Unauthorized AccessIf you fail to block the ports used by applications that run on the application server atthe perimeter firewall, an external attacker can communicate directly with theapplication server. If you allow computers other than the front-end Web servers toconnect to the application server, the attack profile for the application serverincreases.VulnerabilitiesVulnerabilities that can result in unauthorized access include:● Weak perimeter network and firewall configurations● Superfluous ports open on the internal firewall●●●●Lack of IPSec policies to restrict host connectivityUnnecessary active servicesUnnecessary protocolsWeak account and password policies