Security design question

[John Lee]

Hi,

Here is the environment related context:
================================================== =======================
Website are hosted in DMZ - subdomain created dmz.companydomain.com
We have our web farm (3-5 web servers) running under one NT Domain account
with least privileges.
Website all 3 level of access: anonymous, registered and verified
We will use form authentication to authenticate registered and verified user
SQL server will be used to host user authentication information and Session
state
All Line of business web services are hosted internally with Windows
authentication only
AzMan is used to perform access check on all public web methods
================================================== =======================
My question are:

Is this a good practice? Any obvious flaw?
What is the best way to encrypt session state because it might contain
sensitive data?
If the internal web service trust the NT domain account that hosts the web
site, it means that if someone gain access/control to the site then he could
possibly call any of the web service methods, is this correct? how to
prevent it from happening?
What is the best way to secure public access website that will
retrieve/update internal business data?

Thanks very much!
John

[[MSFT]]

Hi John,

From the design, you may consider add some firewall between outside and
your web site, either, between your web server and Web serivce
server/database. This can help block the attcks. Here are some good
articles on ASP.NET security, you may take a look first to see they will
help:


Securing Your ASP.NET Application and Web Services
[url]http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/ht[/url]
ml/THCMCh19.asp

Securing .NET Web Applications in an Intranet Environment
[url]http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secmod/html[/url]
/secmod05.asp

An Introductory Guide to Building and Deploying More Secure Sites with
ASP.NET and IIS
[url]http://msdn.microsoft.com/msdnmag/issues/02/04/aspsec/default.aspx[/url]

Luke