CRV2 SecDepConfig - Revision history

Jerry Kickenson at 18:03, 31 December 2013

2013-12-31T18:03:59Z

Jerry Kickenson at 18:00, 31 December 2013

2013-12-31T18:00:48Z

Jerry Kickenson at 17:42, 31 December 2013

2013-12-31T17:42:43Z

Show changes

Jerry Kickenson at 04:12, 31 December 2013

2013-12-31T04:12:57Z

Jerry Kickenson at 04:08, 31 December 2013

2013-12-31T04:08:46Z

Jerry Kickenson at 03:53, 31 December 2013

2013-12-31T03:53:07Z

Show changes

Jerry Kickenson at 00:39, 31 December 2013

2013-12-31T00:39:52Z

Jerry Kickenson at 03:59, 30 December 2013

2013-12-30T03:59:08Z

Jerry Kickenson at 01:00, 30 December 2013

2013-12-30T01:00:45Z

Jerry Kickenson: Created page with "== Secure Deployment Configuration == Web applications do not execute in isolation. They typically are deployed within an application server framework, running within an oper..."

2013-12-30T00:58:11Z

Created page with "== Secure Deployment Configuration == Web applications do not execute in isolation. They typically are deployed within an application server framework, running within an oper..."

New page

== Secure Deployment Configuration ==
Web applications do not execute in isolation. They typically are deployed within an application server framework, running within an operating system on a physical host, within a network.

Secure operating system configuration (also called hardening) is not typically within the scope of code review. For more information, see the [http://benchmarks.cisecurity.org/downloads/browse/index.cfm?category=benchmarks.os Center for Internet Security operating system benchmarks].

Networks today consist of much more than routers and switches providing transport services. Filtering switches, VLANs (virtual LANs), firewalls, WAFs (Web Application Firewall), and various middle boxes (e.g. reverse proxies, intrusion detection and prevention systems) all provide critical security services when configured to do so. This is a big topic, but outside the scope of this web application code review guide. For a good summary, see the SANS (System Administration, Networking, and Security) Institute [http://www.sans.org/critical-security-controls/control.php?id=10 Critical Control 10: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches].

Application server frameworks have many security related capabilities. These capabilities may be enabled and configured programmatically or declaratively. Programmatic configuration is done within the web application, using framework specific APIs. Declarative configuration is done via static configuration files, typically in XML format.

=== Programmatic Configuration ===

=== Declarative Configuration ===

← Older revision		Revision as of 18:03, 31 December 2013
Line 309:		Line 309:

	The Web.config and ApplicationHost.config files should be included in code review. The <system.webServer><security> sections should be reviewed to ensure all security configuration is as expected.		The Web.config and ApplicationHost.config files should be included in code review. The <system.webServer><security> sections should be reviewed to ensure all security configuration is as expected.
		+
		+	For guidelines on securing the overall configuration of Microsoft IIS, see the [http://benchmarks.cisecurity.org/downloads/show-single/?file=iis7.130 CIS Microsoft IIS 7 Benchmark v1.3.0].

@@ Line 406: / Line 406: @@
 === Programmatic Configuration ===
-The JEE API for programmatic security consists of methods of the EJBContext interface and the HttpServletRequest interface. These methods allow components to make business-logic decisions based on the security role of the caller or remote user.
+====JEE====
 Microsoft IIS security configuration can also be programmatically set from various languages:
@@ Line 462: / Line 545: @@
 When reviewing source code, special attention should be paid to configuration updates in security sections.

← Older revision		Revision as of 04:12, 31 December 2013
Line 304:		Line 304:

	The JEE API for programmatic security consists of methods of the EJBContext interface and the HttpServletRequest interface. These methods allow components to make business-logic decisions based on the security role of the caller or remote user.		The JEE API for programmatic security consists of methods of the EJBContext interface and the HttpServletRequest interface. These methods allow components to make business-logic decisions based on the security role of the caller or remote user.
		+
		+	=== References===

@@ Line 213: / Line 213: @@
 * Host - autoDeploy, deployOnStartup, deployXML
 * Context - crossContext, privileged, allowLinking
 The server.xml file should be reviewed to ensure security related parameters are configured as expected.
@@ Line 291: / Line 296: @@
 More information on WebLogic additional deployment descriptors may be found at [http://docs.oracle.com/cd/E11035_01/wls100/security/thin_client.html#wp1046262 weblogic.xml Deployment Descriptors].
 ===== Microsoft IIS =====

@@ Line 6: / Line 6: @@
 Networks today consist of much more than routers and switches providing transport services.  Filtering switches, VLANs (virtual LANs), firewalls, WAFs (Web Application Firewall), and various middle boxes (e.g. reverse proxies, intrusion detection and prevention systems) all provide critical security services when configured to do so.   This is a big topic, but outside the scope of this web application code review guide.  For a good summary, see the SANS (System Administration, Networking, and Security) Institute [http://www.sans.org/critical-security-controls/control.php?id=10 Critical Control 10: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches].
-Application server frameworks have many security related capabilities.  These capabilities are enabled and configured  declaratively.  Declarative configuration is done via static configuration files, typically in XML format.
+Application server frameworks have many security related capabilities.  These capabilities are enabled and configured  declaratively.  Declarative configuration is usually done via static configuration files, typically in XML format, but may also be expressed as annotations within the code.
 Some security capabilities are accessible from within a Java program.  Programmatic security is done within the web application, using framework specific or standard Java EE APIs.
 === Declarative Configuration ===
 ==== Apache Tomcat ====
@@ Line 25: / Line 94: @@
 === Programmatic Configuration ===

← Older revision		Revision as of 01:00, 30 December 2013
Line 12:		Line 12:

	=== Declarative Configuration ===		=== Declarative Configuration ===
		+
		+	==== Apache Tomcat ====
		+
		+	==== Microsoft IIS ====
		+
		+	==== Oracle WebLogic ====
		+
		+	==== IBM WebSphere AS ====
		+
		+	==== Jetty ====
		+
		+	==== JBoss AS ====