Administration Solutions


For administrators, this guide provides the following solutions:

  • How to implement patch management

    Use the Microsoft Baseline Security Analyzer (MBSA) to detect the patches and updates that may be missing from your current installation. Run this on a regular basis, and keep your servers current with the latest patches and updates. Back up servers prior to applying patches, and test patches on test servers prior to installing them on a production server. Also, use the security notification services provided by Microsoft, and subscribe to receive security bulletins via e-mail.

    For more information, see "How To: Implement Patch Management" in the "How To" section of this guide.

  • How to make the settings in Machine.config and Web.config more secure

    Do not store passwords or sensitive data in plaintext. For example, use the Aspnet_setreg.exe utility to encrypt the values for <processModel> , <identity> , and <sessionState> . Do not reveal exception details to the client. For example do not use mode="Off" for <customErrors> in ASP.NET because it causes detailed error pages that contain system-level information to be returned to the client. Restrict who has access to configuration files and settings. Lock configuration settings if necessary, using the <location> tag and the allowOverride element.

    For more information on improving the security of Machine.config and Web.config for your scenario, see Chapter 19, "Securing Your ASP.NET Application and Web Services." For more information on the <location> tag, see "Machine.Config and Web.Config" explained in Chapter 19, "Securing Your ASP.NET Application and Web Services." For more information on Aspnet_setreg.exe, see "Aspnet_setreg.exe and Process, Session, and Identity" in Chapter 19, "Securing Your ASP.NET Application and Web Services."

  • How to secure a Web server running the .NET Framework

    Apply a methodology to systematically configure the security of your Web server. Secure your accounts, protocols, ports, services, shares, files and directories, and registry. You can use IISLockdown to help automate some of the security configuration. Use a hardened Machine.config configuration to apply stringent security to all .NET Framework applications installed on the server. Most importantly, keep your server current with the latest patches and updates.

    For more information, see Chapter 16, "Securing Your Web Server."

  • How to secure a database server

    Apply a common methodology to evaluate accounts, protocols, ports, services, shares, files and directories, and the registry. Also evaluate SQL Server security settings such as the authentication mode and auditing configuration. Evaluate your authorization approach and use of SQL Server logins, users, and roles. Make sure you have the latest service pack and regular monitor for operating system and SQL Server patches and updates.

    For more information, see Chapter 18, "Securing Your Database Server."

  • How to secure an application server

    Evaluate accounts, protocols, ports, services, shares, files and directories, and the registry. Use Internet Protocol Security (IPSec) or SSL to secure the communication channel between the Web server and the application server, and between the application server and the database server. Review the security of your Enterprise Services applications, Web services, and remoting applications. Restrict the range of ports with which clients can connect to the application server, and consider using IPSec restrictions to limit the range of clients .

    For more information, see Chapter 17, "Securing Your Application Server."

  • How to host multiple ASP.NET applications securely

    Use separate identities to allow you to configure access control lists (ACLs) on secure resources to control which applications have access to them. On the Microsoft Windows Server 2003 operating system, use separate process identities with IIS 6 application pools. On Windows 2000 Server, use multiple anonymous Internet user accounts and enable impersonation. With the .NET Framework version 1.1 on both platforms, you can use partial trust levels and use code access security to provide further application isolation. For example, you can use these methods to prevent applications from accessing each other's virtual directories and critical system resources.

    For more information, see Chapter 20, "Hosting Multiple ASP.NET Applications."

  • How to secure Web services

    In cross-platform scenarios and where you do not control both endpoints, use the Web Services Enhancements 1.0 for Microsoft .NET (WSE) to implement message level security solutions that conform to the emerging WS-Security standard. Pass authentication tokens in Simple Object Access Protocol (SOAP) headers. Use XML encryption to ensure that sensitive data remains private. Use digital signatures for message integrity. Within the enterprise where you control both endpoints, you can use the authentication, authorization, and secure communication features provided by the operating system and IIS.

    For more information, see Chapter 17, "Securing Your Application Server," Chapter 19, "Securing Your ASP.NET Application and Web Services." For information about developing secure Web services, see Chapter 12, "Building Secure Web Services."

  • How to secure Enterprise Services

    Configure server applications to run using least privileged accounts. Enable COM+ role-based security, and enforce component-level access checks. At the minimum, use call-level authentication to prevent anonymous access. To secure the traffic passed to remote serviced components , use IPSec encrypted channels or use remote procedure call (RPC) encryption. Restrict the range of ports that Distributed COM (DCOM) dynamically allocates or use static endpoint mapping to limit the port range to specific ports. Regularly monitor for Quick Fix Engineer (QFE) updates to the COM+ runtime.

    For more information, see Chapter 17, "Securing Your Application Server."

  • How to secure Microsoft .NET Remoting

    Disable remoting on Internet- facing Web servers by mapping .rem and .soap extensions to the ASP.NET HttpForbiddenHandler HTTP module in Machine.config. Host in ASP.NET and use the HttpChannel type name to benefit from ASP.NET and IIS authentication and authorization services. If you need to use the TcpChannel type name, host your remote components in a Windows service and use IPSec to restrict which clients can connect to your server. Use this approach only in a trusted server situation, where the remoting client (for example a Web application) authenticates and authorizes the original callers .

    For more information, see Chapter 17, "Securing Your Application Server."

  • How to secure session state

    You need to protect session state while in transit across the network and while in the state store. If you use a remote state store, secure the communication channel to the state store using SSL or IPSec. Also encrypt the connection string in Machine.config. If you use a SQL Server state store, use Windows authentication when you connect to the state store, and limit the application login in the database. If you use the ASP.NET state service, use a least privileged account to run the service, and consider changing the default port that the service listens to. If you do not need the state service, disable it.

    For more information, see "Session State" in Chapter 19, "Securing Your ASP.NET Application and Web Services."

  • How to manage application configuration securely

    Remote administration should be limited or avoided. Strong authentication should be required for administrative interfaces. Restrict access to configuration stores through ACLs and permissions. Make sure you have the granularity of authorization required to support separation of duties .

    For general considerations for secure configuration management, see Chapter 4, "Design Guidelines for Secure Web Applications." To verify the secure defaults and ensure that you apply secure machine-wide settings and secure application specific settings, see Chapter 19, "Securing Your ASP.NET Application and Web Services."

  • How to secure against denial of service attacks

    Make sure the TCP/IP stack configuration on your server is hardened to protect against attacks such as SYN floods. Configure ASP.NET to limit the size of accepted POST requests and to place limits on request execution times.

    For more information about hardening TCP/IP, see "How To: Harden the TCP/IP Stack" in the "How To" section of this guide. For more information about ASP.NET settings used to help prevent denial of service, see Chapter 19, "Securing Your ASP.NET Application and Web Services."

  • How to constrain file I/O

    You can configure code access security policy to ensure that individual assemblies or entire Web applications are limited in their ability to access the file system. For example, by configuring a Web application to run at the Medium trust level, you prevent the application from being able to access files outside of its virtual directory hierarchy.

    Also, by granting a restricted file I/O permission to a particular assembly you can control precisely which files it is able to access and how it should be able to access them.

    For more information, see Chapter 9, "Using Code Access Security with ASP.NET" and "How To: Use Code Access Security Policy to Constrain an Assembly" in the "How To" section of this guide.

  • How to perform remote administration

    Terminal Services provides a proprietary protocol (RDP.) This supports authentication and can provide encryption. If you need a file transfer facility, you can install the File Copy utility from the Windows 2000 Server resource kit. The use of IIS Web administration is not recommended and this option is removed if you run IISLockdown. You should consider providing an encrypted channel of communication and using IPSec to limit the computers that can be used to remotely administer your server. You should also limit the number of administration accounts.

    For more information, see the "Remote Administration" sections in Chapter 16, "Securing Your Web Server" and Chapter 18, "Securing Your Database Server."




Improving Web Application Security. Threats and Countermeasures
Improving Web Application Security: Threats and Countermeasures
ISBN: 0735618429
EAN: 2147483647
Year: 2003
Pages: 613

flylib.com © 2008-2017.
If you may any questions please contact us: flylib@qtcs.net