Improving Web Application Security: Threats and - CGISecurity

710 Improving Web Application Security: Threats and CountermeasuresAuthorization (continued)Check DescriptionComponent-level access checks are enforced for all serviced components. Classes areannotated with:[ComponentAccessControl(true)]To support method-level security, the [SecurityMethod] attribute is used on classes ormethod implementations, or the [SecurityRole] attribute is used on methodimplementations.Configuration ManagementCheck DescriptionServer applications are configured to run with least-privileged accounts.Server applications only run using the interactive user account during development.Object constructor strings do not contain plain text secrets.Sensitive DataCheck DescriptionIn the absence of IPSec encryption, RPC encryption is used to secure sensitive data over thenetwork in the absence of an IPSec infrastructure. Serviced component assemblies that useRPC encryption include:[assembly: ApplicationAccessControl(Authentication = AuthenticationOption.Privacy)]Auditing and LoggingCheck DescriptionUser transactions are logged to an event log. The audit record includes original caller identityfrom SecurityCallContext.OriginalCaller.Deployment ConsiderationsCheck DescriptionPort ranges are defined if you use dynamic port range allocation OR static endpoint mappingis configured.Secrets are not stored in object constructor strings. Secrets such as database connectionstrings are encrypted prior to storage.The server application run-as account is configured as a least-privileged account.