So I plan on updating some data via an ASMX web service on a web server via .NET programs running elsewhere. The primary security concern is that this web service needs to spawn a process to handle the data. I'm utilizing the built in windows authentication system and restricting access to a local web server's windows group. I plan on spawning the process via impersonation of a user with only the necessary permissions to accomplish its tasks. The user will only be used to launch this program. Is this an ok design or do I have a glaring issue that I've overlooked?
Impersonation user is hard coded into program. If data is modified in transit, not particularly catastrophic, program runs nightly without any personal or secure data being sent. Would be an issue if data was always modified, but that seems to imply a permanent middle man attack.