Improving Web Application Security: Threats and - CGISecurity

556 Part IV: Securing Your Network, Host, and ApplicationUse the element to configure the application’s trust level. By default, theconfiguration level is set to Full, as shown below:This means that the application is granted full and unrestricted CAS permissions.With this configuration, the success or failure of any resource access performed by theapplication depends only on operating system security.If you change the trust level to a level other than Full, you may break existingASP.NET Web applications depending on the types of resources they access and theoperations they perform. Applications should be thoroughly tested at each trust level.For more information about building partial-trust Web applications that use CAS, seeChapter 9, “Using Code Access Security with ASP.NET.” For more information aboutusing trust levels to provide application isolation, see Chapter 20, “Hosting MultipleASP.NET Web Applications.”Process Identity for ASP.NETASP.NET Web applications and Web services run in a shared instance of the ASP.NETworker process (Aspnet_wp.exe). Process-level settings, including the processidentity, are configured using the element in Machine.config.The identity for the ASP.NET worker process is configured using the userName andpassword attributes on the element. When you configure processidentity:● Use the default ASPNET account.●●●Use a least-privileged custom account.Encrypt credentials.Do not run ASP.NET as SYSTEM.Use the Default ASPNET AccountThe local ASPNET account is the default least privileged account specifically forrunning ASP.NET Web applications and Web services. Use this account if you can byusing the following default configuration: