Improving Web Application Security: Threats and - CGISecurity

Chapter 9: Using Code Access Security with ASP.NET 239This illustrates that an unrestricted permission set (full trust) is used in a link demandthat protects the System.Data.OleDb.OleDbCommand class. In scenarios such asthis, it is not sufficient to configure policy to grant specific unrestricted permissions,such as OleDbPermission, to your partial-trust code. Instead, you must sandboxyour resource access code and grant it full trust, and the easiest way to do this is toinstall it in the GAC. Use Permview.exe to find out about the permissionrequirements of other classes, although this only shows declarative securityattributes. If a class imperatively demands full trust, you cannot see this throughPermview.exe. In this event, test the security requirements of the class by calling itfrom partial-trust code and diagnosing any security exceptions.Note Just because an assembly is marked with APTCA, it does not mean all of the containedclasses support partial-trust callers. Some classes may include explicit demands for full trust.Medium TrustIf you host Web applications, you may choose to implement a medium trust securitypolicy to restrict privileged operations. This section focuses on running medium trustapplications, and shows you how to overcome the problems you are likely toencounter.Running at medium trust has the following two main benefits:● Reduced attack surface● Application isolationReduced Attack SurfaceSince medium trust does not grant the application unrestricted access to allpermissions, your attack surface is reduced by granting the application a subset ofthe full permission set. Many of the permissions granted by medium trust policy arealso in a restricted state. If an attacker is somehow able to take control of yourapplication, the attacker is limited in what he or she can do.Application IsolationApplication isolation with code access security restricts access to system resourcesand resources owned by other applications. For example, even though the processidentity might be allowed to read and write files outside of the Web applicationdirectory, the FileIOPermission in medium trust applications is restricted. It onlypermits the application to read or write to its own application directory hierarchy.