Securing .NET applications
Security is an important part of the design process when creating .NET applications, and cannot be left until the implementation phase. A fully integrated security policy will provide the greatest protection against your application being subverted and simplify the process of integrating security functionality into your code. You cannot retrofit a comprehensive security model into a design.
For details on designing a secure .NET application, read Section 4.1 of Programming .NET Security from O'Reilly Media.
Roughly speaking, a permission is a fine-grained privilege that can be given to .NET code. If the .NET code is not given a certain privilege, it cannot perform an action that requires that privilege. For example, it is considered a privilege for .NET code to write to the file system. If code is not granted a permission for this, trying to write to the file system will generate a security error. No privileges are automatically granted to code.
Read about permissions, an important .NET security concept, in the "Permissions Explained" Section in Chapter 6 of .NET Framework Security from Addison Wesley.
