Lazycoder

Securing Connection Strings

So when you are storing the registry key in a ACL’ed registry key, who has access to the key? What profile? Doesn’t user profile running your web application process have to have access to the ACL’ed registry key containing your connection string? What happens if someone compromises your web application and can run code under the web apps user profile, don’t they gain access to your encrypted registry key anyway?

“Sure, but it’s encrypted.” Well, if they’ve gained access to your web apps user profile, meaning they can run the web application, don’t they have access to the decrypting code too?

Along those lines, if they also gain access to your web config and the ability to decrypt your connection string store in it.

Little things like encrypting connection strings are only the first step in securing your web applications. If you encrypt something and leave the key sitting around, is it really still secure? Think about the security of the infrastructure as well as intrusion points in your applications. It’s not just about prevention, it’s about containment as well. That’s the reason prisons not only have bars on the cells, but have a big wall outside.