Improving Web Application Security: Threats and - CGISecurity

602 Part IV: Securing Your Network, Host, and ApplicationSummaryIf you host multiple ASP.NET applications on a single Web server, you need toconsider how applications are isolated from one another and from shared systemresources such as the file system, registry, and event logs. Without adequate isolation,a rogue or badly developed application can adversely affect other applications on theserver.On Windows Server 2003, use the multiple worker process model supported by IIS 6to provide operating system process isolation for applications. On Windows 2000,process isolation is not possible, although multiple applications can be configured touse separate anonymous user accounts. This provides separate application auditingand supports independent application authorization.On both platforms you can use the resource constraint model provided by codeaccess security as an additional control to restrict which applications have access towhich resource types. The use of code access security with ASP.NET applicationsrequires version 1.1 of the .NET Framework.For more information about securing ASP.NET applications, see Chapter 19,“Securing Your ASP.NET Applications and Web Services.”