Improving Web Application Security: Threats and - CGISecurity

How To:Use Code Access Security Policyto Constrain an AssemblyApplies ToThis information applies to server or workstation computers that run the following:● Microsoft ® Windows ® 2000 Server and the Windows 2000 Professional,Windows Server 2003, Windows XP Professional operating systems● Microsoft .NET Framework version 1.1SummaryAn administrator can configure code access security policy to constrain theoperations of .NET Framework code (assemblies.) In this How To, you configure codeaccess security policy to constrain the ability of an assembly to perform file I/O andrestrict file I/O to a specific directory.You use the.NET Framework 1.1 Configuration tool to create a new permission setand a new code group. The permission set defines what the code can and cannot do,and the code group associates the permission set with particular code, for example aspecific assembly or set of assemblies.In addition to constraining file I/O, you can use code access security policy to imposeother constraints on code. For example, you can restrict the ability of code to accessother types of resources protected by code access security, including databases,directory services, event log, registry, Domain Name System (DNS) servers,unmanaged code, and environment variables.Note This list is not exhaustive but represents many of the common resource types accessed byWeb applications.