Improving Web Application Security: Threats and - CGISecurity

Chapter 21: Code Review 621Do You Store Secrets?If your assembly stores secrets, review the design to check that it is absolutelynecessary to store the secret. If you have to store a secret, review the followingquestions to do so as securely as possible:● Do you store secrets in memory?Do not store secrets in plaintext in memory for prolonged periods. Retrieve thesecret from a store, decrypt it, use it, and then substitute zeros in the space wherethe secret is stored.● Do you store plaintext passwords or SQL connection strings in Web.config orMachine.config?Do not do this. Use aspnet_setreg.exe to store encrypted credentials in theregistry on the , , and elements. Forinformation on obtaining and using Aspnet_setreg.exe, see Microsoft KnowledgeBase article 329290, “How To: Use the ASP.NET Utility to Encrypt Credentials andSession State.”● How do you encrypt secrets?Check that the code uses DPAPI to encrypt connection strings and credentials.Do not store secrets in the Local Security Authority (LSA), as the account used toaccess the LSA requires extended privileges. For information on using DPAPI, see“How To: Create a DPAPI Library” in the “How To” section of “Microsoft patterns& practices Volume I, Building Secure ASP.NET Applications: Authentication,Authorization, and Secure Communication” at http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/SecNetHT07.asp.●●Do you store secrets in the registry?If so, check that they are first encrypted and then secured with a restricted ACL ifthey are stored in HKEY_LOCAL_MACHINE. An ACL is not required if the codeuses HKEY_CURRENT_USER because this is automatically restricted toprocesses running under the associated user account.Are you concerned about reverse engineering?If so, consider an obfuscation tool. For more information, see the list of obfuscatortools listed at http://www.gotdotnet.com/team/csharp/tools/default.aspx.Note Do not rely on an obfuscation tool to hide secret data. Obfuscation tools make identifyingsecret data more difficult but do not solve the problem.