Improving Web Application Security: Threats and - CGISecurity

480 Part IV: Securing Your Network, Host, and ApplicationMethodologyBy securing the communication channels to the application server and preventingany hosts except authorized Web servers from accessing the application server,attackers are limited to application-layer attacks that exploit vulnerabilities in Webapplication design and development.To mitigate this risk, developers must apply the secure design and developmentapproaches described in Parts II and III of this guide.The configuration solutions in this chapter are specific to the application server andthey should not be applied in isolation. Apply them alongside the solutions presentedin Chapter 15, “Securing Your Network,” Chapter 16, “Securing Your Web Server,”and Chapter 18, “Securing Your Database Server.”Communication Channel ConsiderationsSensitive application data and authentication credentials that are sent to and from theapplication server should be encrypted to provide privacy and integrity. Thismitigates the risk associated with eavesdropping and tampering.Encrypting network traffic addresses the network eavesdropping and tamperingthreats. If you consider this threat to be negligible in your environment — forexample, because your application is located in a closed and physically securednetwork — then you do not need to encrypt the traffic. If network eavesdropping is aconcern, then you can use SSL, which provides a secure communication channel atthe application layer, or IPSec, which provides a transport-level solution. IPSecencrypts all IP traffic that flows between two servers, while SSL allows eachapplication to choose whether or not to provide an encrypted communicationchannel.Enterprise ServicesEnterprise Services (or COM+) applications communicate over the network usingDCOM over RPC. RPC uses port 135, which provides endpoint mapping services toallow clients to negotiate parameters, including the communication port, which bydefault is dynamically assigned.The Enterprise Service channel can be secured in one of two ways:● RPC EncryptionYou can configure an Enterprise Services application for RPC Packet Privacyauthentication. In addition to authentication, this provides encryption for everydata packet sent to and from the Enterprise Services application.● IPSecYou can use an IPSec policy between the Web server and the application server toencrypt the communication channel.