Improving Web Application Security: Threats and - CGISecurity

Chapter 17: Securing Your Application Server 489What Does the .NET Framework Install?When you install the .NET Framework, the following components that relate toEnterprise Services are installed.Table 17.2 .NET Framework Enterprise Services Tools and Configuration SettingsItemRegsvcs.exeDescriptionCommand line tool used to register Enterprise Services components withCOM+LibrariesSystem.EnterpriseServices.dllSystem.EnterpriseServices.Thunk.dllSystem.EnterpriseServices.tlbMachine.configConfiguration ElementsIf you call Enterprise Services from ASP.NET, the following entries inMachine.config are relevant:Loads the System.EnterpriseServices assembly for ASP.NET.The comAuthentication attribute configures ASP.NET authentication levels.DCOM authentication levels are negotiated between the client (for example,the Web application) and the server (the Enterprise Services application).The higher of the two security settings is used.The comImpersonationLevel attribute configures ASP.NET impersonationlevels (for all outgoing DCOM calls). The client determines theimpersonation capabilities that are granted to the server.To secure the component services infrastructure, consider the following items:● Patches and updates● Services● Ports● COM+ catalogPatches and UpdatesUpdate the application server with the latest service packs and patches to mitigatethe risks posed by viruses, worms, and Trojan horses. The software that needs to beregularly updated includes the operating system, which includes IIS and the .NETFramework.