Improving Web Application Security: Threats and - CGISecurity

494 Part IV: Securing Your Network, Host, and ApplicationAuthentication LevelEnterprise Services applications authenticate callers using RPC, which in turn usesthe underlying authentication services of the operating system provided through theSecurity Service Provider Interface (SSPI) layer. This means that applicationsauthenticate callers using Windows authentication; either Kerberos or NTLM.RPC defines authentication levels that determine when authentication occurs andwhether the authenticated communication should be checked for integrity orencrypted. At minimum, you should use call-level authentication to ensure that everymethod call to a serviced component method is authenticated.Note Call-level authentication does not result in the encryption of message data. As a result, ifnetwork eavesdropping is a real concern, use the packet privacy authentication level, or use call-levelauthentication over a channel secured with IPSec.Table 17.3 shows the various authentication levels:Table 17.3 Enterprise Services Application Authentication LevelsAuthentication Level DescriptionDefaultChoose authentication level using normal negotiation rulesNoneConnectCallPacketPacket integrityPacket privacyNo authenticationOnly authenticates credentials when the client initially connects to theserverAuthenticates at the start of each remote procedure callAuthenticates all data received from the clientAuthenticates all data and verifies that none of the transferred data hasbeen modifiedAuthenticates all data and encrypts all packets transmitted using RPCencryption To set call-level authentication1. Start Component Services and display the Properties dialog box of theapplication.2. Click the Security tab.3. Select Call from the Authentication level for calls drop-down list.