Improving Web Application Security: Threats and - CGISecurity

576 Part IV: Securing Your Network, Host, and ApplicationBin DirectoryThe bin directory beneath an ASP.NET application’s virtual root directory containsthe application’s private assemblies, including the application’s page-classimplementations if code-behind files have been used during development.Secure the Bin DirectoryTo secure the application’s bin directory and protect your business logic againstinadvertent download:● Remove Web permissions.●Remove all authentication settings.Remove Web PermissionsUse the IIS snap-in and ensure that the bin directory does not have Read, Write, orDirectory browsing permissions. Also ensure Execute permissions are set to None.Remove All Authentication SettingsUse the IIS snap-in to remove authentication settings from the bin directory. Thisresults in all access being denied.Event LogLeast privileged accounts, such as ASPNET, have sufficient permissions to be able towrite records to the event log using existing event sources. However, they do nothave sufficient permissions to create new event sources. To do this, you must place anew entry beneath the following registry key:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\To avoid this issue, you can create event sources at installation time whenadministrator privileges are available. You can use a .NET installer class, which canbe instantiated by the Windows Installer (if you are using .msi deployment) or by theInstallUtil.exe system utility if you are not. For more information about using eventlog installers, see Chapter 10, “Building Secure ASP.NET Web Pages and Controls.”If you are unable to create event sources at installation time, you must addpermission to the following registry key and grant access to the ASP.NET processaccount or to any impersonated account if your application uses impersonation.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog