Improving Web Application Security: Threats and - CGISecurity

Chapter 19: Securing Your ASP.NET Application and Web Services 585Snapshot of a Secure ASP.NET ApplicationThe following snapshot view shows the attributes of a secure ASP.NET applicationand allows you to quickly and easily compare settings with your own configuration.Table 19.4 Snapshot of a Secure ASP.NET Application ConfigurationComponentProcess identityCharacteristicsThe ASP.NET worker process runs as ASPNET:The custom account (if used) is least privileged.The custom account credentials are encrypted in the registry:ImpersonationImpersonation identities are encrypted in the registry:AuthenticationThe Web site is partitioned for public and restricted access.The Forms authentication configuration is secure:The authentication cookie is encrypted and integrity checked.SSL is required for authentication cookie.Sliding expiration is set to false, if SSL is it is not used.The session lifetime is restricted.Cookie names and paths are unique.The element is not used.(continued)