Code access security in asp.net and web services

[mcowen]

I'm involved in a large .net project which is mainly asp.net. One of the requirements is to have all access to data made via web services. The reasoning I've been given for this approach is that this is more secure than a traditional website that accesses a database directly. If the web server is compromised then the hacker will not have access to the database and would have to cross another application domain to get it. A hacker would have access to modify code and run any code they wish. Is this really possible?

My concern is that this approach is going to be too slow. As far as security is concerned isn't it just a matter of adding the correct code access permissions? I know that web services are superb for geographically dispersed applications but this website is going to sit next to the sql server database with minimal 3rd party integration. Does anyone have any thoughts on this approach?

Matt

 

[ca8msm]

Making data available via a web service or via the application doesn't make it less or more secure. They both would require some form on authentication, and if that authentication is compromised then you have a problem.

Personally, I wouldn't go down the web service route unless you need to expose the data to various clients.


-------------------------------------------------------

Mark,
[URL unfurl="true"]http://aspnetlibrary.com[/url]
[URL unfurl="true"]http://mdssolutions.co.uk[/url] - Delivering professional ASP.NET solutions
[URL unfurl="true"]http://weblogs.asp.net/marksmith[/url]

 

[jbenson001]

Web services will be slower. We use them here where I work because we need to allow an outside network access our DB. As Mark said, this is the only time you should use them.

 

[jmeckley]

a hacker won't care about the code, only the data. the easiest way to get to the database is the connection string stored in the config file or deconstruct the assembly and read the connection string from some variable.

if security is compromised and the hacker can access the server they won't use the gui or serivce to get the data. they'll connection directly to the database and dump the tables.

as stated before. if security is breached, it doesn't matter how you access the data, you can still access it.

Jason Meckley
Programmer
Specialty Bakers, Inc.