Improving Web Application Security: Threats and - CGISecurity

498 Part IV: Securing Your Network, Host, and ApplicationCRM Log FilesIf your Enterprise Services application uses the CRM, you should ensure that theCRM log files are secured to prevent potential information disclosure. Depending onthe nature of the application, the files can contain sensitive application data. TheCRM log files are created in the following directory:%windir%\system32\dtclogCRM log file names are derived from the Enterprise Services application ID and havethe file name extension .crmlog. CRM log files are secured when they are created byEnterprise Services and the file is configured with an ACL that grants Full Control tothe run-as account of the application. No other account has access.If you change the identity of the application after the log file is created, you mustmanually change the ACL on the file. Make sure that the new run-as identity of theapplication has Full Control permissions.Application AssembliesTo protect the deployed application assemblies that contain the serviced componentsof the application, you should harden the ACL associated with the assembly .dll filesto ensure they cannot be replaced or deleted by unauthorized users.Apply the following ACL to the DLL folder of your application:Users: ExecuteApplication Run as account: ExecuteAdministrators: Read, Write and ExecuteThe location of the assembly DLLs of an application is specified at deployment timeand may therefore vary from installation to installation. The Properties dialog box inthe Component Services tool does not show the assembly DLL location. Instead, itpoints to %windir%\System32\mscoree.dll, which provides the interception servicesfor the component. To check the location of application DLLs1. Start the Component Services tool and expand your application in the tree control.2. Expand the Components folder, select a component, right-click it, and then clickProperties.3. In the Properties dialog box, retrieve the Class ID (CLSID) of the component.4. Start Regedt32.exe and locate the retrieved CLSID beneathHKEY_CLASSES_ROOT\CLSID.5. Click the InprocServer32 key.The DLL location is indicated by the CodeBase named value.