Improving Web Application Security: Threats and - CGISecurity

20Hosting Multiple Web ApplicationsIn This Chapter●●●OverviewUsing multiple identities for application isolationUsing Microsoft Windows Server 2003 application pools for application isolationUsing code access security for application IsolationIf you host multiple ASP.NET Web applications on a shared Web server, you need toconsider application isolation. For example, how can you ensure that individualapplications will not affect one another at runtime? How can you prevent a singlerogue or badly written application from consuming critical system level resources onthe server that keeps other applications from running properly?The issue is particularly significant for Internet Service Providers (ISPs) who hostlarge numbers of applications from different companies. In a hosting scenario, it isessential to ensure that the installation of a new application cannot adversely impactthe operation of existing applications.There are a number of ways in which application isolation can be achieved. Theavailable options vary depending on the version of the .NET Framework and theversion of the operating system that you run on the Web server. If you are runningversion 1.1 of the .NET Framework, you can use the resource constraint modelprovided by code access security to provide one level of application isolation. Thisapplication isolation is achieved by restricting an application from to access differenttypes of resources such as the file system, registry, event log, Active Directory,databases, network resources, and so on.