Improving Web Application Security: Threats and - CGISecurity

Solutions at a Glance lxxi●●●●How to secure a database serverApply a common methodology to evaluate accounts, protocols, ports, services,shares, files and directories, and the registry. Also evaluate SQL Server securitysettings such as the authentication mode and auditing configuration. Evaluateyour authorization approach and use of SQL Server logins, users, and roles. Makesure you have the latest service pack and regular monitor for operating systemand SQL Server patches and updates.For more information, see Chapter 18, “Securing Your Database Server.”How to secure an application serverEvaluate accounts, protocols, ports, services, shares, files and directories, and theregistry. Use Internet Protocol Security (IPSec) or SSL to secure the communicationchannel between the Web server and the application server, and between theapplication server and the database server. Review the security of your EnterpriseServices applications, Web services, and remoting applications. Restrict the rangeof ports with which clients can connect to the application server, and considerusing IPSec restrictions to limit the range of clients.For more information, see Chapter 17, “Securing Your Application Server.”How to host multiple ASP.NET applications securelyUse separate identities to allow you to configure access control lists (ACLs)on secure resources to control which applications have access to them. On theMicrosoft Windows Server 2003 operating system, use separate process identitieswith IIS 6 application pools. On Windows 2000 Server, use multiple anonymousInternet user accounts and enable impersonation. With the .NET Frameworkversion 1.1 on both platforms, you can use partial trust levels and use code accesssecurity to provide further application isolation. For example, you can use thesemethods to prevent applications from accessing each other’s virtual directoriesand critical system resources.For more information, see Chapter 20, “Hosting Multiple ASP.NET Applications.”How to secure Web servicesIn cross-platform scenarios and where you do not control both endpoints, use theWeb Services Enhancements 1.0 for Microsoft .NET (WSE) to implement messagelevel security solutions that conform to the emerging WS-Security standard. Passauthentication tokens in Simple Object Access Protocol (SOAP) headers. Use XMLencryption to ensure that sensitive data remains private. Use digital signatures formessage integrity. Within the enterprise where you control both endpoints, youcan use the authentication, authorization, and secure communication featuresprovided by the operating system and IIS.For more information, see Chapter 17, “Securing Your Application Server,”Chapter 19, “Securing Your ASP.NET Application and Web Services.” Forinformation about developing secure Web services, see Chapter 12, “BuildingSecure Web Services.”