Improving Web Application Security: Threats and - CGISecurity

Chapter 22: Deployment Review 667●●What authentication level do you use?The authentication level specified on the element inMachine.config governs the authentication level used for outgoing calls to remoteserviced components or DCOM components. The higher of this value and thevalue configured at the remote server is used. Check the comAuthenticationLevelsetting on the element:What impersonation level do you use?This affects outgoing calls from the library component to other remotecomponents. Check the comImpersonationLevel attribute on the element in Machine.config.AuthorizationServiced components in Enterprise Services applications use COM+ role basedsecurity to authorize callers. Review the following issues to ensure appropriateauthorization:● Are access checks enabled?This controls whether or not COM+ authorization is enabled or not. Check thatEnforce access checks for this application is selected on the Security page of theapplication’s Properties dialog box in Component Services.●What security level do you use?Check the Security level specified on the Security page of the application’sProperties dialog box in Component Services. Applications should use processand component level access checks to support granular authorization. This allowsthe application to use roles to control access to specific classes, interfaces, andmethods.Note Process and component level access checks must be enabled for library applications oryou will not be able to use role-based authorization.●Do you enforce component level access checks?To support authorization checks at the component, interface, and method levels,each component must be appropriately configured in the COM+ catalog. Checkeach component in your application to ensure that Enforce component levelaccess checks is selected on the Security page of the component’s Propertiesdialog box.