Improving Web Application Security: Threats and - CGISecurity

Checklist: Securing ASP.NET 703Hosting Multiple ApplicationsCheck DescriptionApplications have distinct machine keys.Use IsolateApps on or use per application elements.Unique path/name combinations for Forms authentication cookies are enabled for eachapplication.Multiple processes (IIS 6.0 application pools) are used for application isolation on MicrosoftWindows®Server 2003.Multiple anonymous user accounts (and impersonation) are used for application isolation onWindows 2000.Common machine keys are enabled on all servers in a Web farm.Separate machine keys for each application are used when hosting multiple applications ona single server.Code access security trust levels are used for process isolation and to restrict access tosystem resources (requires .NET Framework version 1.1).ACLs and PermissionsCheck DescriptionTemporary ASP.NET files%windir%\Microsoft.NET\Framework\{version}Temporary ASP.NET FilesASP.NET process account and impersonated identities: Full ControlTemporary directory(%temp%)ASP.NET process account: Full Control.NET Framework directory%windir%\Microsoft.NET\Framework\{version}ASP.NET process account and impersonated identities:Read and ExecuteList Folder Contents(continued)