Improving Web Application Security: Threats and - CGISecurity

Chapter 16: Securing Your Web Server 465Remove All Permissions for the Local Intranet ZoneThe local intranet zone applies permissions to code running from UNC shares orinternal Web sites. Reconfigure this zone to grant no permissions by associating itwith the Nothing permission set. To remove all permissions for the local intranet zone1. Start the Microsoft .NET Framework version 1.1 Configuration tool from theAdministrative Tools program group.2. Expand Runtime Security Policy, expand Machine, and then expand CodeGroups.3. Expand All_Code and then select LocalIntranet_Zone.4. Click Edit Code Group Properties.5. Click the Permission Set tab.6. Select Nothing from the drop-down Permission list.7. Click OK.The dialog box shown in Figure 16.6 is displayed.Figure 16.6Setting LocalIntranet_Zone code permissions to NothingRemove All Permissions for the Internet ZoneThe Internet zone applies code access permissions to code downloaded over theInternet. On Web servers, this zone should be reconfigured to grant no permissionsby associating it with the Nothing permission set.Repeat the steps shown in the preceding section, “Remove All Permissions for theLocal Intranet Zone,” except set the Internet_Zone to the Nothing permission set.