[I know this is quite subjective, and dependant on various considerations, so I’m just finishing for ideas to see what people think on the subject, and what considerations they are taking…]
We have an asp.net application exposed publicly (username/password authentication required), which, in turn, uses a set of WCF services in the back.
I am trying to decide which binding to use for these services, and more specifically – which security elements, if any, we should use.
all applications (web front end and all services) reside on the same server farm, behind a firewall, which blocks all access to the services other than from the web application.
Under these circumstances – would you say its acceptable not to have any security elements (and so, presumably, have increased performance?)
For completeness I would say that we do expect to expose some services, externally, at some point, but this will be done via a different endpoint, with a different address, using high security elements including federated identity for authentication
Security is like a wall. The more walls the better.
That is why we have secure passwords for databases that are internal but accessed from web app’s, and why we encrypt sensitive data in those databases.
If the security isn’t going to be a major pain, add it.