Improving Web Application Security: Threats and - CGISecurity

668 Part V: Assessing Your SecurityRemote Serviced ComponentsThe following issues apply if you use remote serviced components, andcommunication is across a network. A typical scenario is an ASP.NET clientcommunicating with an Enterprise Services application on a remote applicationserver.● Do you pass sensitive data?If so, what mechanism is in place to address the network eavesdropping threat?Make sure the link between client and server is encrypted at the transport level,for example, by IPSec. Alternatively, make sure your Enterprise Servicesapplication is configured for Packet Privacy level authentication, which forces theuse of RPC encryption for all data packets sent to and from the application.● Do you communicate through a firewall?Enterprise Services uses DCOM, which in turn uses RPC communication. RPCcommunication requires port 135 to be open on the firewall. Review your firewalland Enterprise Services configuration to ensure that only the minimal additionalports is open.The range of ports dynamically allocated by DCOM can be restricted or staticendpoint mapping can be used to specify individual ports. For more information,see Chapter 17, “Securing Your Application Server.”RemotingThis section identifies the key review points that should be considered when youreview your application’s use of .NET Remoting. For more information about theissues raised in this section see Chapter 17, “Securing Your Application Server.”When you review your .NET Remoting solution, start by identifying which hostis used to run your remote components. If you use the ASP.NET host with theHttpChannel, you need to check that IIS and ASP.NET security is appropriatelyconfigured to provide authentication, authorization, and secure communicationservices to your remote components. If you use a custom host and the TcpChannel,you need to review how your components are secured, because this host and channelcombination requires custom authentication and authorization solutions.Port ConsiderationsRemoting is not designed to be used with Internet clients. Check that the ports thatyour components listen on are not directly accessible by Internet clients. The portor ports are usually specified on the element in the server sideconfiguration file.