MACROMEDIA COLDFUSION 5-ADVANCED ADMINISTRATION, Manual

Page: 81 / 372

Choosing a Level of ColdFusion Security 63
Basic security covers all phases of application development and deployment. Basic
security is a good solution for trusted users because it offers them a single access
level—complete control. Consider implementing Basic security if you have legacy
systems or other security models in place.
Basic security also requires very little support from the ColdFusion Server
administrator: You’ll want to choose a password that can’t be easily guessed and
change it regularly, but aside from that, Basic security won’t require much of your
time. Developers, on the other hand, will need to spend more time writing their
applications; granular run-time access security is possible with Basic security, but
involves custom development.
Advanced Security, on the other hand, allows you a great deal of flexibility and
control, but requires more time and greater effort to set up and maintain than Basic
security. Depending on how you implement it, Advanced Security can also affect
performance when developers try to access resources from ColdFusion studio or
when users try to run ColdFusion applications.
The following sections examine the effects of Basic and Advanced security on
application development and deployment, and on administrative access to
ColdFusion Server. Remember that when you select Basic or Advanced security,
you’re making a global choice that affects all aspects of ColdFusion. You can’t, for
instance, select Basic security for server administration and Advanced security for
RDS. This section is organized by major task simply to help you prioritize your
security concerns and then select the type of ColdFusion security that best meets the
majority of your needs.
Developing applications
Basic and Advanced security both restrict access to ColdFusion servers from
ColdFusion Studio. You can restrict access by developers who connect to ColdFusion
servers over a local area network as well as by developers who use RDS to access
ColdFusion servers.
Developing applications with Basic security
Basic security for application development hinges on the protection of a single
password per server. As long as you change the password frequently and your users
keep it secret, you should not have to worry about unauthorized access to the
directories and resources on your ColdFusion server. Before you choose Basic
security, it is imperative that you understand the security liabilities of this model:
•
Password vulnerability If the password is lost, hacked, or stolen, server security
is compromised. See “Data encryption” on page 61 for information about
protecting communications, including password transmissions, between your
server and clients.
•
Generalized access control Remote developers have access either to all files
and data sources, or none. Basic security does not let you protect individual
directories or resources.