Improving Web Application Security: Threats and - CGISecurity

636 Part V: Assessing Your SecurityServiced ComponentsThis section identifies the key review points that you should consider when youreview the serviced components used inside Enterprise Services applications. Formore information about the issues raised in this section, see Chapter 11, “BuildingSecure Serviced Components.”● Do you use assembly level metadata?● Do you prevent anonymous access?● Do you use a restricted impersonation level?● Do you use role-based security?● Do you use method level authorization?● Do you use object constructor strings?● Do you audit in the middle tier?Do You Use Assembly Level Metadata?Check that you use assembly level metadata to define Enterprise Services securitysettings. Use the assemblyinfo.cs file and use attributes to define authentication andauthorization configuration. This helps to ensure that the settings are establishedcorrectly at administration time. Although the administrator can override thesesettings, it provides the administrator with a clear definition of how you expect thesettings to be configured.Do You Prevent Anonymous Access?Check that your code specifies an authentication level using theApplicationAccessControl attribute. Search for the “AuthenticationOption” string tolocate the relevant attribute. Check that you use at least call-level authentication toensure that each call to your component is authenticated.[assembly: ApplicationAccessControl(Authentication = AuthenticationOption.Call)]Do You Use a Restricted Impersonation Level?The impersonation level you define for your serviced components determines theimpersonation capabilities of any remote server that you communicate with. Searchfor the “ImpersonationLevel” string to check that your code sets the level.[assembly: ApplicationAccessControl(ImpersonationLevel=ImpersonationLevelOption.Identify)]