Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have been reading a security checklist for web application design which can be found on:

http://msdn.microsoft.com/en-us/library/ff648647.aspx

One of the recommendations is to "use multiple gatekeepers". I have read the explanation for it but I didn't understand anything. Here is the explanation:

On the server side, you can use IP Security Protocol (IPSec) policies to provide host restrictions to restrict server-to-server communication. For example, an IPSec policy might restrict any host apart from a nominated Web server from connecting to a database server. IIS provides Web permissions and Internet Protocol/ Domain Name System (IP/DNS) restrictions. IIS Web permissions apply to all resources requested over HTTP regardless of the user. They do not provide protection if an attacker manages to log on to the server. For this, NTFS permissions allow you to specify per user access control lists. Finally, ASP.NET provides URL authorization and File authorization together with principal permission demands. By combining these gatekeepers you can develop an effective authorization strategy.

Basically, what I would like to know is, what is meant by "multiple gatekeepers"? Thank you :)

share|improve this question

2 Answers 2

up vote 4 down vote accepted

While I personally disagree to the use of the term "gatekeepers" in this sense, I believe they are referring to the various defense components/modules that make-up a defense in depth stratergy for the same.

An example of this would be, while a web.config file cannot be read via HTTP in plaintext, any user logged into the system via a remote desktop solution (SSH, rDesktop, VNC, TeamViewer,PowerShell, etc) would be able to read it clearly. In such a case, not only wil you have to configure IIS Web Permissions to block access but you will have to be configure NTFS (File System) permissions to specify which users may read/write/execute that particular file.

Therefore, I believe they are saying that a serial combination of these "gatekeepers" will help you in developing an effective authorization stratergy.

share|improve this answer
    
Thank you very much Rohan Durve :) Now I understand. Thank you for your detailed and clear explanation :) –  Matthew Sep 14 '13 at 13:01
1  
Glad I could be of help. :) –  Rohan Durve - Decode141 Sep 19 '13 at 10:54
1  
Thanks again sir :) –  Matthew Sep 19 '13 at 15:28

We used a static IP or an IP ranges as a second factor authenticator for privileged users and devices. See also OWASP Application Security Verification Standard https://www.owasp.org/index.php/Category%3aOWASP_Application_Security_Verification_Standard_Project although I did not find IP multifactor authentication covered there.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.