Improving Web Application Security: Threats and - CGISecurity

544 Part IV: Securing Your Network, Host, and ApplicationThis chapter describes what is new with ASP.NET from a system administrator’sstandpoint and how to configure machine-wide and application-specific securitysettings.How to Use This ChapterThis chapter focuses on the key security considerations for ASP.NET applications.To get the most out of this chapter:● Read Chapter 16, “Securing Your Web Server.” This shows you how to secure theWindows 2000 operating system and the Microsoft .NET Framework. A secureunderlying platform is a prerequisite for securing an ASP.NET Web application orWeb service.● Use the snapshot. Table 19.4, which is at the end of this chapter, gives a snapshotof a secure ASP.NET application with secure configuration settings inMachine.config and Web.config. Use this table when configuring your server andapplication settings.● Use the checklist. The “Checklist: Securing Your ASP.NET Application” in the“Checklist” section of this guide provides a printable job aid for quick reference.Use the task-based checklist to quickly evaluate the scope of the required stepsand to help you work through individual steps.For related guidance, read Chapter 20, “Hosting Multiple ASP.NET Applications,”which shows you how to isolate multiple Web applications running on the sameserver from critical system resources and from one another. For more informationabout configuring code access security (CAS) policy for partial-trust Web applicationsand Web services, see Chapter 9, “Using Code Access Security with ASP.NET.”MethodologyTo secure your ASP.NET application, start with a hardened operating system and.NET Framework installation base, and then apply secure application configurationsettings to reduce the application’s attack profile. The methodology that is applied inthis chapter to secure ASP.NET Web applications and Web services is consistent withthe methodology used to secure the underlying Web server host, and it sharescommon configuration categories. These include:● Services. The .NET Framework installs the ASP.NET state service to manage outof-processASP.NET session state. Secure the ASP.NET state service if you install it.Disable the ASP.NET state service if you do not require it.● Protocols. Restrict Web service protocols to reduce the attack surface area.