Improving Web Application Security: Threats and - CGISecurity

Chapter 19: Securing Your ASP.NET Application and Web Services 545●●●Accounts. The default ASPNET account is created for running Web applications,Web services, and the ASP.NET state service. If you create custom accounts to runprocesses or services, they must be configured as least privileged accounts withthe minimum set of required NTFS permissions and Windows privileges.Files and Directories. Application Bin directories that are used to hold privateassemblies should be secured to mitigate the risk of an attacker downloadingbusiness logic.Configuration Store. Many security-related settings that control functional areassuch as authentication, authorization, session state, and so on, are maintained inthe Machine.config and Web.config XML configuration files. To secure ASP.NETapplications, you must use secure configuration settings.What You Must KnowBefore you begin securing your Web applications and Web services, there areoverarching considerations and details of which you should be aware.ASP.NET Process ModelIn Microsoft Windows 2000, Internet Information Services (IIS) 5.0 runs all Webapplications and Web services in the ASP.NET worker process (Aspnet_wp.exe).The unit of isolation is the application domain and each virtual directory has itsown application domain. Process-level configuration settings are maintained bythe element in Machine.config.In Microsoft Windows Server 2003, IIS 6.0 application pools allow you to isolateapplications using separate processes. For more information, see Chapter 20,“Hosting Multiple ASP.NET Applications.”ASP.NET AccountThe ASPNET account is a least privileged, local account created when you install the.NET Framework. By default, it runs the ASP.NET worker process and the ASP.NETstate service.If you decide to run Web applications using a custom account, make sure youconfigure the account with minimum privileges. This reduces the risks associatedwith an attacker who manages to execute code using the application’s securitycontext. You must also specify the account’s credentials on the element. Make sure you do not store credentials in plaintext. Instead, use theAspnet_setreg.exe tool to store encrypted credentials in the registry. The customaccount must also be granted the appropriate NTFS permissions.