Improving Web Application Security: Threats and - CGISecurity

lxxImproving Web Application Security: Threats and CountermeasuresAdministration SolutionsFor administrators, this guide provides the following solutions:● How to implement patch managementUse the Microsoft Baseline Security Analyzer (MBSA) to detect the patches andupdates that may be missing from your current installation. Run this on a regularbasis, and keep your servers current with the latest patches and updates. Backup servers prior to applying patches, and test patches on test servers prior toinstalling them on a production server. Also, use the security notification servicesprovided by Microsoft, and subscribe to receive security bulletins via e-mail.For more information, see “How To: Implement Patch Management” in the“How To” section of this guide.● How to make the settings in Machine.config and Web.config more secureDo not store passwords or sensitive data in plaintext. For example, use theAspnet_setreg.exe utility to encrypt the values for , ,and . Do not reveal exception details to the client. For example donot use mode=“Off” for in ASP.NET because it causes detailederror pages that contain system-level information to be returned to the client.Restrict who has access to configuration files and settings. Lock configurationsettings if necessary, using the tag and the allowOverride element.For more information on improving the security of Machine.config andWeb.config for your scenario, see Chapter 19, “Securing Your ASP.NETApplication and Web Services.” For more information on the tag,see “Machine.Config and Web.Config” explained in Chapter 19, “SecuringYour ASP.NET Application and Web Services.” For more information onAspnet_setreg.exe, see “Aspnet_setreg.exe and Process, Session, and Identity”in Chapter 19, “Securing Your ASP.NET Application and Web Services.”● How to secure a Web server running the .NET FrameworkApply a methodology to systematically configure the security of your Web server.Secure your accounts, protocols, ports, services, shares, files and directories, andregistry. You can use IISLockdown to help automate some of the securityconfiguration. Use a hardened Machine.config configuration to apply stringentsecurity to all .NET Framework applications installed on the server. Mostimportantly, keep your server current with the latest patches and updates.For more information, see Chapter 16, “Securing Your Web Server.”