Improving Web Application Security: Threats and - CGISecurity

546 Part IV: Securing Your Network, Host, and ApplicationAspnet_setreg.exe and Process, Session, and IdentityAspnet_setreg.exe allows you to store credentials and connection strings in encryptedformat in the registry. This tool allows you to encrypt the following attributes:● ● ● The following example shows the element with a custom accountboth before and after running Aspnet_setreg.exe to secure the credentials:You can choose the registry location that stores the encrypted data, although it mustbe beneath HKEY_LOCAL_MACHINE. In addition to encrypting the data using theData Protection API (DPAPI) and storing it in the registry, the tool applies a secureACL to restrict access to the registry key. The ACL on the registry key grants FullControl to System, Administrators, and Creator Owner. If you use the tool toencrypt the credentials for the element or the connection string for the element, you must also grant read access to the ASP.NET processaccount.To obtain the Aspnet_setreg.exe tool and for more information, see MicrosoftKnowledge Base article 329290, “How To: Use the ASP.NET Utility to EncryptCredentials and Session State Connection Strings.”Impersonation is Not the DefaultBy default, ASP.NET applications do not impersonate. As a result, resource access isperformed using the ASP.NET worker process identity. You must grant the processidentity read access (at minimum) to the Windows resources that your applicationrequires access to by creating an appropriately configured ACL.If you do enable impersonation, you can either impersonate the original caller — thatis, the IIS authenticated identity — or a fixed identity specified on the element. For more information, see “Impersonation” later in this chapter.