Improving Web Application Security: Threats and - CGISecurity

664 Part V: Assessing Your SecurityUse the following questions to help review the security configuration of yourWeb service:● Have you disabled the Documentation protocol?If you do not want to expose your Web services endpoints, then you can removethe Documentation protocol from the element in Machine.config andmanually distribute the .Web Services Description Language (WSDL) file tospecific Web service consumers.● Have you disabled the HTTP Get and Post protocols?By disabling (commenting) HttpGet and HttpPost protocols from element in Machine.config file, you help to reduce the attack profile for your Webservices.● Do you restrict access to WSDL?If you store the generated .WSDL files on the Web server to distribute them to theconsumers, make sure that the files are protected by an appropriate ACL. Thisprevents a malicious user from updating or replacing the WSDL so that it pointsto endpoints that differ from the intended URL.● Do you pass sensitive data in SOAP requests or responses?If your Web service handles sensitive data, how do you protect the data over thenetwork and address the network eavesdropping threat? Do you use SSL or IPSecencrypted channels, or do you encrypt parts of the message by using XMLencryption?● How do you authenticate callers?If your Web service exposes restricted operations or data, it needs to authenticatecallers to support authorization. Review how the Web service authenticates itsclients.● Do you pass credentials in SOAP headers?If you pass credentials in SOAP headers, are they passed in plaintext? If they are,make sure an encrypted channel is used.Enterprise ServicesThis section identifies the key review points that should be considered when youreview your Enterprise Services applications and components. For more informationabout the issues raised in this section, see Chapter 17, “Securing Your ApplicationServer.”When you review Enterprise Services applications consider the following issues:● Accounts● Files and directories● Authentication● Authorization● Remote serviced component