Improving Web Application Security: Threats and - CGISecurity

Chapter 17: Securing Your Application Server 481.NET RemotingTwo possible implementation models exist for applications that use .NET Remoting:● HTTP channel over port 80This model uses ASP.NET as the hosting service.● TCP channel over any portIn this model, the application is hosted inside a custom executable, usually aWindows service.Depending on the performance and security requirements of the application, you canuse one of two methods to secure the Remoting channel.● Use SSL with the HTTPChannel.If you host in ASP.NET, you can take advantage of the built-in HTTPSfunctionality provided by IIS. HTTPS provides authentication and secure datacommunication.● Use IPSec with the TCPChannel.With the TCP channel, you can use an IPSec policy to provide transport-layerencryption for all IP data. Note that if you use the TCP channel, you must provideyour own authentication mechanism. For more information, see Chapter 13,“Building Secure Remoted Components.”Web ServicesWeb services are hosted by ASP.NET and IIS, and the services use the HTTP protocolfor communication over the network.SSL or IPSec can be used to secure the communication channel. Alternatively,encryption can be handled at the application layer by encrypting the messagepayload or the sensitive parts of the payload. To do this using open standards, usethe Web Services Enhancements (WSE) download available for Web services. Formore information, see Chapter 12, “Building Secure Web Services.”SQL ServerThe application server communicates with SQL Server using TCP port 1433 bydefault. Unless otherwise configured, UDP port 1434 is also used for negotiation.To secure the channel from the application server to SQL Server, use IPSec or SSL.SSL requires a server certificate to be installed on the database server.For more information on using SSL with SQL Server, see Microsoft Knowledge Basearticle 276553, “How To: Enable SSL Encryption for SQL Server 2000 with CertificateServer.”