Improving Web Application Security: Threats and - CGISecurity

486 Part IV: Securing Your Network, Host, and ApplicationFor more information on SQL Server port requirements, see Chapter 18, “SecuringYour Database Server.”.NET Remoting Security ConsiderationsThe .NET Remoting infrastructure enables applications to communicate with oneanother on the same machine or across machines in a network. The Remotinginfrastructure can use the HTTP or TCP transports for communication and can sendmessages in many formats, the most common of which are SOAP or binary format.Hosting in a Windows Service (TCP Channel)Because the Remoting infrastructure provides no default authentication andauthorization mechanisms, it is not recommended for use by Internet-facingapplications. It is designed for applications that run in a trusted environment and iswell suited for Web server communication to remote application servers, which isshown in Figure 17.5.Web Server(Client)TCP ChannelIPSec(SecureCommunication)WindowsServiceHostFigure 17.5Remoting with the TCP channel and a Windows service hostIn this scenario, a Windows service hosts the Remoting objects and communicationoccurs through a TCP channel. This approach offers good performance, but does notnecessarily address security. For added security, use IPSec between the Web serverand the application server and only allow the Web server to establish connectionswith the application server.Hosting in IIS (HTTP Channel)To benefit from the security features provided by ASP.NET and IIS, host yourremote components in ASP.NET and use the HTTP channel for communication,as Figure 17.6 shows.