RES: Web app based on .net - best practice?

["Mads Rasmussen" <mads () opencs com br>]

Thanks Dennis,

Certainly helpful!

I found this paper while surfing after more information

http://activeanswers.compaq.com/aa_downloads/6/100/225/1/51547.doc

Regards,

Mads

> -----Mensagem original-----
> De: Dennis Hurst [mailto:dhurst () spidynamics com]
> Enviada em: quarta-feira, 23 de abril de 2003 12:52
> Para: webappsec () securityfocus com; Mads Rasmussen
> Assunto: RE: Web app based on .net - best practice?
>
> Mads,
>
> Microsoft has a pretty good set of documentation that answers a lot of
> the questions your looking for.  I haven't read 100% of it so I can't
> give an opinion yet but here is the link:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetse
> c/html/secnetlpMSDN.asp?frame=true
>
> Hope it helps.
>
> Have a great day,
>
> Dennis Hurst
> dhurst () spidynamics com
> SPI Labs
>
>
>
> -----Original Message-----
> From: Mads Rasmussen [mailto:mads () opencs com br]
> Sent: Wednesday, April 23, 2003 9:42 AM
> To: webappsec () securityfocus com
> Subject: Web app based on .net - best practice?
>
>
>
> Imagine I have a .net based application
>
> I thought it would be a good idea to have the presentation layer (asp)
> in a DMZ and the business layer (components in VB and C#) in a safe
site
> behind a firewall. The communication in between would take place with
> RPC calls.
> I know that RPC is not considered secure but we have a firewall in
> between the DMZ and the safe site (not a guarantee things work out, I
> know)
>
> I wondered what Microsoft says about the division of the layers, is
> there a recommendation or some kind of best practice for something
like
> this?
>
> Do any know of pointers to information about this?
>
> My concern is that if the whole application was based in the DMZ, it
> would be hard to control injections and stuff like that. With the
> division we can control (somewhat) what calls goes to the safe site
> (business layer).
>
> I would love to hear opinions on this matter
>
> Thanks,
>
> Mads
>
> --
> Mads Rasmussen
> Consultant
> Av. Engenheiro Luis Carlos Berrini, 550
> 11º. Andar - conj. 111 - Brooklin - S.P. Brasil
> +55 11 3345-2525 Phone
> +55 11 3345-2526 Fax
> http://www.opencs.com.br/