Improving Web Application Security: Threats and - CGISecurity

386 Part III: Building Secure Web ApplicationsSecure UDL Files with Restricted ACLsIf your application uses external universal data link (UDL) files with the ADO.NETmanaged data provider for OLE DB, use NTFS permissions to restrict access. Use thefollowing restricted ACL:Administrators: Full ControlProcess Account: ReadNote UDL files are not encrypted. A more secure approach is to encrypt the connection string usingDPAPI and store it in a restricted registry key.Sensitive DataMany Web applications store sensitive data of one form or another in the database.If an attacker manages to execute a query against your database, it is imperative thatany sensitive data items — such as credit card numbers — are suitably encrypted.● Encrypt sensitive data if you need to store it.●●Secure sensitive data over the network.Store password hashes with salt.Encrypt Sensitive Data if You Need to Store ItAvoid storing sensitive data if possible. If you must store sensitive data, encrypt thedata.Using 3DES EncryptionTo store sensitive data, such as credit card numbers, in the database, use a strongsymmetric encryption algorithm such as 3DES. During development, to enable 3DES encryption1. Use the RNGCryptoServiceProvider class to generate a strong (192 bit, 24 byte)encryption key.2. Back up the encryption key, and store the backup in a physically secure location.3. Encrypt the key with DPAPI and store it in a registry key. Use the following ACLto secure the registry key:Administrators: Full ControlProcess Account (for example ASPNET): Read