Chapter 8: ColdFusion Security
277
restrictive security plan. The more public the application or development
environment, the lower the level of trust.
Basic security covers all phases of application development and deployment. Basic
security is a good solution for trusted users because it offers them a single access level
— complete control. Consider implementing Basic security if you have legacy systems
or other security models in place.
Basic security also requires very little support from the ColdFusion Server
administrator: You’ll want to choose a password that can’t be easily guessed and
change it regularly, but aside from that, Basic security won’t require much of your time.
Developers, on the other hand, will need to spend more time writing their
applications; granular run-time access security is possible with Basic security, but
involves custom development.
Advanced Security, on the other hand, allows you a great deal of flexibility and control,
but requires more time and greater effort to set up and maintain than Basic security.
Depending on how you implement it, Advanced Security can also affect performance
when developers try to access resources from ColdFusion studio or when users try to
run ColdFusion applications.
The following sections examine the effects of Basic and Advanced security on
application development and deployment, and on administrative access to
ColdFusion Server. Remember that when you select Basic or Advanced security, you’re
making a global choice that affects all aspects of ColdFusion. You can’t, for instance,
select Basic security for server administration and Advanced security for RDS. This
section is organized by major task simply to help you prioritize your security concerns
and then select the type of ColdFusion security that best meets the majority of your
needs.
Developing Applications
Basic and Advanced security both restrict access to ColdFusion servers from
ColdFusion Studio. You can restrict access by developers who connect to ColdFusion
servers over a local area network as well as by developers who use RDS to access
ColdFusion servers.
Developing Applications with Basic Security
Basic security for application development hinges on the protection of a single
password per server. As long as you change the password frequently and your users
keep it secret, you shouldn’t have to worry about unauthorized access to the
directories and resources on your ColdFusion server. Before you choose Basic security,
it’s imperative that you understand the security liabilities of this model:
•
Password vulnerability
— If the password is lost, hacked, or stolen, server
security is compromised. See
“Data Encryption” on page 275
for information
about protecting communications, including password transmissions, between
your server and clients.
Summary of Contents for COLDFUSION 4.5-ADMINISTRING COLDFUSION...
Page 1: ...Allaire Corporation Administering ColdFusion Server ColdFusion 4 5...
Page 10: ...x Administering ColdFusion Server...
Page 22: ...xxii AdministeringColdFusionServer...
Page 48: ...26 Administering ColdFusion Server...
Page 58: ...36 Administering ColdFusion Server...
Page 60: ...38 Administering ColdFusion Server Using ColdFusion in a Distributed Configuration 68...
Page 98: ...76 Administering ColdFusion Server...
Page 150: ...128 Administering ColdFusion Server...
Page 198: ...176 Administering ColdFusion Server...
Page 205: ...Chapter 6 Creating Scalable and Highly Available Web Sites 183 3 Click the DNS tab...
