Improving Web Application Security: Threats and - CGISecurity

Chapter 22: Deployment Review 665AccountsIf you use an Enterprise Services server application, check which account you useto run the application. This is displayed on the Identity page of the application’sProperties dialog box in Component Services. Review the following questions:●●Do you use a least privileged account?Check the account that you use to run your Enterprise Services server applicationsto ensure they are configured as least privileged accounts with restricted userrights and access rights. If you use the process account to access a downstreamdatabase, make sure that the database login is restricted in the database.Do you use the Interactive account?Do not use the Interactive account on production servers. This is only intendedto be used during development and testing.Files and DirectoriesReview the following questions to ensure that you are using NTFS permissionsappropriately to secure the various files associated with an Enterprise Servicesapplication:● Is the COM+ catalog secured?The COM+ catalog maintains configuration data for COM+ applications. Makesure that the following folder that maintains the catalog files is configured witha restricted ACL.%windir%\registrationConfigure the following ACL:Administrators: Read, WriteSystem: Read, WriteEnterprise Services Run-As Account(s): Read●●Are the CRM log files secured?If your application uses the Compensating Resource Manager, the CRM log files(.crmlog) should be secured with NTFS permissions because the log files maycontain sensitive application data.Are your application DLLs secured?Make sure that the folder used to hold the DLLs of your application is configuredwith the following restricted ACL.Users: ExecuteApplication Run as account: ExecuteAdministrators: Read, Write and ExecuteFor more information, see Chapter 17, “Securing Your Application Server.”