Improving Web Application Security: Threats and - CGISecurity

Chapter 22: Deployment Review 661This element is used to specify encryption and validation keys, and the algorithmsused to protect Forms authentication cookies and page level view state.●Do you run multiple applications on the same server?If so, use the IsolateApps setting to ensure a separate key is generated for eachWeb application.●●Do you run in a Web farm?If so, make sure that you use specific machine keys and copy them across allservers in the farm.Do you protect view state?If you protect view state, for example, by setting enableViewSetMac=“true” onthe element, set validation=“SHA1” (Secure Hash Algorithm) or “3DES”on the element. The Triple Data Encryption Standard (3DES)setting is required if you also encrypt the Forms authentication cookie by settingprotection=“All” on the element.The element determines the code access security trust level used to runASP.NET Web applications and Web services.● What version of the .NET Framework do you run?If you run .NET Framework 1.0 then the trust level must be set to Full. Forversions equal to or greater than 1.1, you can change it to one of the following:●What trust level do you use?Based on security policy and the agreement with the development team; set anappropriate trust level for the application either in Web.config or inMachine.config.