Improving Web Application Security: Threats and - CGISecurity

670 Part V: Assessing Your SecurityHosting in a Custom Process with the TcpChannelIf you use a custom host process such as a Windows service, review the followingitems.● How do you protect sensitive data over the network?Have you secured the channel from client to server? You may use transport levelIPSec encryption or your application may use a custom encryption sink to encryptrequest and response data.● How do you authenticate callers?The TcpChannel provides no authentication mechanism, so you must developyour own. Review how your application authenticates its callers.● Do you restrict your clients?Remoting with the TcpChannel is designed to be used in trusted server scenarios,where the remote components trust their clients. Do you restrict the range ofclients that can connect to your remote components, for example, by using IPSecpolicies?● Do you use a least privileged process identity?Review which account you use to run your custom host process and ensure it isconfigured as a least privileged account.Database Server ConfigurationThe goal for this phase of the review is to identify vulnerabilities in the configurationof your SQL Server database server. For further background information about theissues raised by the review questions in this section, see Chapter 18, “Securing YourDatabase Server.”To help focus and structure the review process, the review questions have beendivided into the following configuration categories:● Patches and updates● Services● Protocols● Accounts● Files and directories● Shares● Ports● Registry● Auditing and logging● SQL Server security● SQL Server logins, users, and roles