Improving Web Application Security: Threats and - CGISecurity

Chapter 17: Securing Your Application Server 493Secure Enterprise Services ApplicationsIndividual application configuration settings are maintained in the COM+ catalogand can be configured using the Component Services tool or by using script. Many ofthe settings discussed below can also be specified by application developers by usingthe correct assembly level metadata in the serviced component assembly. When youregister the service component, for example by using Regsvcs.exe, the COM+ catalogis automatically configured using this metadata, although the application run-asidentity must be configured administratively.To secure an Enterprise Services application, you must configure the following items:●●●●●●Identity (run as)Authentication levelCOM+ role based securityImpersonationCRM log filesApplication assembliesIdentity (Run As)Configure Enterprise Services server applications to run with least privilegedaccounts. This reduces the potential damage that might occur if the server process iscompromised by an attacker who manages to execute code using its security context.If the serviced components within the Enterprise Services application are notimpersonating the caller’s security context, then the process-level identity specifiedthrough the run-as account is used for downstream local and remote resource access.To support network authentication to a remote database server, you can create a“mirrored” local account, which is a local account on the remote server that has amatching username and password.Note When you set the run-as identity with Enterprise Services, the required “Logon as a batchjob” privilege is automatically granted to the account.