1. Securing Enterprise Applications Rich Cole

2. Agenda Sample Enterprise Architecture Sample Enterprise Architecture Example of how University Apps uses Defense in Depth to manage connections to the database from the application servers. Example of how University Apps uses Defense in Depth to manage connections to the database from the application servers.

3. Enterprise Architecture

4. Managing Connections

5. Security - Defense in Depth SOURCE: MICROSOFT Problem: Where to hide the database connection string used by the application to connect to the database?

6. Connection Manager Solution: Use a middle tier component to run a stored procedure in a secured “locked down” database to obtain the connection string for the application. Solution: Use a middle tier component to run a stored procedure in a secured “locked down” database to obtain the connection string for the application.

7. Security - Defense in Depth SOURCE: MICROSOFT

8. How it works

9. Benefits Connection string is stored in secure database and not in clear text on web server. Connection string is stored in secure database and not in clear text on web server. Database table containing connection strings is locked down. No Select/Insert/Update/Delete permissions. Database table containing connection strings is locked down. No Select/Insert/Update/Delete permissions. Only stored procedure allowed to run using middle tier component with its own user id and password. Only stored procedure allowed to run using middle tier component with its own user id and password. Developers need only know application name. Developers need only know application name.