Improving Web Application Security: Threats and - CGISecurity

Solutions at a Glance lxxiii●●●How to secure against denial of service attacksMake sure the TCP/IP stack configuration on your server is hardened to protectagainst attacks such as SYN floods. Configure ASP.NET to limit the size ofaccepted POST requests and to place limits on request execution times.For more information about hardening TCP/IP, see “How To: Harden the TCP/IPStack” in the “How To” section of this guide. For more information aboutASP.NET settings used to help prevent denial of service, see Chapter 19, “SecuringYour ASP.NET Application and Web Services.”How to constrain file I/OYou can configure code access security policy to ensure that individual assembliesor entire Web applications are limited in their ability to access the file system. Forexample, by configuring a Web application to run at the Medium trust level, youprevent the application from being able to access files outside of its virtualdirectory hierarchy.Also, by granting a restricted file I/O permission to a particular assembly you cancontrol precisely which files it is able to access and how it should be able to accessthem.For more information, see Chapter 9, “Using Code Access Security with ASP.NET”and “How To: Use Code Access Security Policy to Constrain an Assembly” in the“How To” section of this guide.How to perform remote administrationTerminal Services provides a proprietary protocol (RDP.) This supportsauthentication and can provide encryption. If you need a file transfer facility,you can install the File Copy utility from the Windows 2000 Server resource kit.The use of IIS Web administration is not recommended and this option is removedif you run IISLockdown. You should consider providing an encrypted channel ofcommunication and using IPSec to limit the computers that can be used toremotely administer your server. You should also limit the number ofadministration accounts.For more information, see the “Remote Administration” sections in Chapter 16,“Securing Your Web Server” and Chapter 18, “Securing Your Database Server.”