Improving Web Application Security: Threats and - CGISecurity

Solutions at a Glance lxvii●●●How to perform security reviews of managed codeUse analysis tools such as FxCop to analyze binary assemblies and to ensurethat they conform to the .NET Framework design guidelines. Fix any securityvulnerabilities identified by your analysis tools. Use a text search facility to scanyour source code base for hard-coded secrets such as passwords. Then, reviewspecific elements of your application including Web pages and controls, dataaccess code, Web services, serviced components, and so on. Pay particularattention to SQL injection and cross-site scripting vulnerabilities.Also review the use of sensitive code access security techniques such as linkdemands and asserts. For more information, see Chapter 21, “Code Review.”How to secure a developer workstationYou can apply a methodology when securing your workstation. Secure youraccounts, protocols, ports, services, shares, files and directories, and registry.Most importantly, keep your workstation current with the latest patches andupdates. If you run Internet Information Services (IIS) on Microsoft Windows ® XPor Windows 2000, then run IISLockdown. IISLockdown applies secures IISconfigurations and installs the URLScan Internet Security ApplicationProgramming Interface (ISAPI) filter, which detects and rejects potentiallymalicious HTTP requests. You may need to modify the default URLScanconfiguration, for example, so you can debug Web applications duringdevelopment and testing.For more information, see “How To: Secure Your Developer Workstation,” in the“How To” section of this guide.How to use code access security with ASP.NETWith.NET Framework version 1.1, you can set ASP.NET trust levels either inMachine.config or Web.config. These trust levels use code access security torestrict the resources that ASP.NET applications can access, such as the file system,registry, network, databases, and so on. In addition, they provide applicationisolation.For more information about using code access security from ASP.NET, developingpartial trust Web applications, and sandboxing privileged code, see Chapter 9,“Using Code Access Security with ASP.NET.”For more information about code access security fundamentals, see Chapter 8,“Code Access Security in Practice.”For more information about the code access security issues that you need toconsider when developing managed code, see the “Code Access SecurityConsiderations” sections in Chapter 11, “Building Secure Serviced Components,”Chapter 12, “Building Secure Web Services,” “Building Secure RemotedComponents,” and Chapter 14, “Building Secure Data Access.”