Enterprise Library Test Guide - Willy .Net

Testing for Security Best Practices 147
Check
Yes
Yes
Yes
Yes
Description
Use the appropriate key sizes for the chosen cryptography algorithm. Identify and document
any reasons for not following this guideline.
Do not store keys in code and configuration files.
Restrict access to persisted keys.
Periodically cycle keys.
Secrets Checklist
Table 35 lists the secrets recommendations.
Table 35: Secrets Checklist
Check
Yes
No
No
Description
Do not hard-code secrets.
Do not store plaintext secrets in configuration files. The connection strings that the
Data Access Application Block uses to connect to databases are stored in the configuration
files. The Data Access Application Block threat model documents this issue. It
recommends that you encrypt the configuration file. For more information on how to do
this, see Configuring the Application Blocks in the Enterprise Library documentation.
Do not store plaintext secrets in memory for extended periods of time.
Currently, the Caching Application Block cannot encrypt information.
continued