Improving Web Application Security: Threats and - CGISecurity

594 Part IV: Securing Your Network, Host, and ApplicationThe main components of the architecture depicted by Figure 20.2 are summarized inTable 20.3.Table 20.3 Components of the Windows Server 2003 ASP.NET ArchitectureComponent DescriptionAspnet_isapi.dll Queues requests for processing by the managed code ASP.NET engine andperforms health monitoring.Aspnet_filter.dllW3wp.exeAspnet_state.exeA lightweight ISAPI filter used only to support cookie-less session state forASP.NET applications. Runs inside W3wp.exe.The IIS worker process that contains the managed code ASP.NET processingengine. The URL space can be arbitrarily divided among different W3wp.exeinstances using IIS 6 application pools. A Web garden mode is also supported.Requests are routed to the W3wp.exe process instance directly from Http.syswhich runs in kernel mode. By default, the process runs under the NetworkService account but can be configured.An optional Windows service used to store session state for ASP.NETapplications. It can run on the Web server or on a remote machine (required forWeb farm scenarios). Runs under the Network Service account but can beconfigured using the Services snap-in.Isolating Applications by IdentityYou can isolate ASP.NET Web applications from an operating system identitystandpoint by controlling the account identity used to run each application. If eachapplication uses a separate fixed account identity, you can authorize and audit eachapplication separately.Note If you host an ASP.NET Web application built using the .NET Framework version 1.0, theprocess account needs appropriate permissions to the root of the current file system drive. For moreinformation, see Microsoft Knowledge Base article 317955, “FIX: ‘Failed to Start MonitoringDirectory Changes’ Error Message When You Browse to an ASP.NET Page.”There are two ways to use separate fixed identities for each application on a sharedWeb server:● Anonymous account impersonation● Fixed identity impersonation