Improving Web Application Security: Threats and - CGISecurity

718 Improving Web Application Security: Threats and CountermeasuresAuthorizationCheck DescriptionCalling users are restricted using declarative or imperative principal permission checks(normally performed by business logic).Calling code is restricted using identity permission demands in scenarios where you knowand want to limit the calling code.Application login is restricted in the database and can only execute selected storedprocedures. Application’s login has no direct table access.Configuration ManagementCheck DescriptionWindows authentication is used to avoid credential management.Connection strings are encrypted and encrypted data is stored securely, for example, in arestricted registry key.OLE DB connection strings do not contain Persist Security Info=“true” or “yes”.UDL files are secured with restricted ACLs.Sensitive DataCheck DescriptionSensitive data is encrypted in the database using strong symmetric encryption (forexample, 3DES).Symmetric encryption keys are backed up and encrypted with DPAPI and stored in arestricted registry key.Sensitive data is secured over the network by using SSL or IPSec.Passwords are not stored in custom user store databases. Password hashes are storedwith salt values instead.