Improving Web Application Security: Threats and - CGISecurity

Chapter 19: Securing Your ASP.NET Application and Web Services 577At minimum, the account(s) must have the following permissions:●●●●●●Query key valueSet key valueCreate subkeyEnumerate subkeysNotifyReadFile AccessAny file that your application accesses must have an access control entry (ACE) inthe ACL that grants, at minimum, read access to the ASP.NET process account orimpersonated identity. Normally, ACLs are configured on the directory and the fileinherits the setting.In addition to using NTFS permissions to restrict access to files and directories, youcan also use ASP.NET trust levels to place constraints on Web applications and Webservices to restrict which areas of the file system they can access. For example,Medium-trust Web applications can only access files within their own virtualdirectory hierarchy.For more information about ASP.NET CAS policy, see Chapter 9, “Using Code AccessSecurity with ASP.NET.”ACLs and PermissionsThe ASP.NET process account and, for certain directories, any impersonationidentities (if your applications use impersonation) require the following NTFSpermissions. The permissions shown in Table 19.3 should be used in addition to anypermissions your applications might require to access application-specific file systemresources.