Improving Web Application Security: Threats and - CGISecurity

704 Improving Web Application Security: Threats and CountermeasuresACLs and Permissions (continued)Check Description.NET Framework configuration directory%windir%\Microsoft.NET\Framework\{version}\CONFIGASP.NET process account and impersonated Identities:Read and ExecuteList Folder ContentsReadWeb site rootC:\inetpub\wwwrootor the path that the default Web site points toASP.NET process account: Full ControlSystem root directory%windir%\system32ASP.NET process account: ReadGlobal assembly cache%windir%\assemblyProcess account and impersonated identities: ReadContent directoryC:\inetpub\wwwroot\YourWebAppProcess account:Read and ExecuteList Folder ContentsReadNote With .NET Framework version 1.0, all parent directories from the content directory tothe file system root directory also require the above permissions. Parent directories include:C:\C:\inetpub\C:\inetpub\wwwroot\Application Bin DirectoryCheck DescriptionIIS Web permissions are configured.Bin directory does not have Read, Write, or Directory browsing permissions. Executepermissions are set to None.Authentication settings are removed (so that all access is denied).