Improving Web Application Security: Threats and - CGISecurity

588 Part IV: Securing Your Network, Host, and ApplicationSummaryThis chapter has shown you how to secure an ASP.NET Web application or Webservice by focusing on configuration categories that include accounts, services,protocols, files and directories, and configuration data that are maintained inMachine.config and Web.config files. This chapter has also shown you how to securethe various functional areas that are relied upon by ASP.NET Web applications andWeb services, including authentication, authorization, session state, and data access.For a related checklist, see “Checklist: Securing ASP.NET” in the “Checklist” sectionof this guide.Additional ResourcesFor more information, see the following resources and articles:●●●●●●You can download Web Services Enhancements (WSE) 1.0 SP1 for Microsoft .NETat http://microsoft.com/downloads/details.aspx?FamilyId=06255A94-2635-4D29-A90C-28B282993A41&displaylang=en.Microsoft Knowledge Base article 329290, “How To: Use the ASP.NET Utility toEncrypt Credentials and Session State Connection Strings.”Microsoft Knowledge Base article 311209, “How To: Configure ASP.NET forPersistent SQL Server Session State Management.”Microsoft Knowledge Base article 312906, “How To: Create Keys by Using VisualC# .NET for Use in Forms.”“How To: Implement Kerberos Delegation for Windows 2000” in the “How To”section of “Microsoft patterns & practices Volume I, Building Secure ASP.NETApplications: Authentication, Authorization, and Secure Communication” athttp://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/SecNetHT05.asp.For more information on security considerations from the Open Hack competition,see MSDN article “Building and Configuring More Secure Web Sites” athttp://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/openhack.asp.