Improving Web Application Security: Threats and - CGISecurity

How To: Secure Your Developer Workstation 767 To create accounts for development1. Remove your current user account from the Administrators group if it is amember.2. Create a new custom administration account using a nonstandard name andstrong password.3. Use your non-administrator account to logon interactively on a daily basis. Whenyou need to run a command with administrative privileges, use your customadministration account with the Runas.exe command line utility.Running Privileged CommandsTo run a privileged command, you can use one of the following techniques totemporarily change your security context:● Use the Runas.exe utility from a command line. The following command showsyou how to use the Runas.exe utility to launch a command console that runsunder your custom administration account.runas.exe /user:mymachine\mycustomadmin cmd.exe●●By executing Cmd.exe, you start a new command window that runs under thesecurity context of the user you specify with the /user switch. Any program youlaunch from this command window also runs under this context.Use Run As from Windows Explorer. You can right-click an executable file inWindows Explorer and click Run As. To display this item on Windows 2000, holdthe shift key down and then right-click an executable file. When you click Run As,you are prompted for the credentials of the account you want to use to run theexecutable file.Use Run As shortcuts. You can create quick launch and desktop shortcuts to easilyrun applications using a privileged user account. The following example shows ashortcut that you can use to run Windows Explorer (Explorer.exe) using theadministrator account:%windir%\System32\runas.exe /user:administrator explorerNote If using a non-administrator account proves impractical for your environment, still test yourapplication or component while running as a least privileged user to catch and correct problemsbefore deploying. For example, your application might incorrectly require administrator privilegeswithout your realizing it, which would cause the application to fail when it is deployed in a productionenvironment.