.NET Security

• Permissions are used to control the access to protected resources and operations.

• Principal is the security context that is attached to every executing thread in the CLR. It also holds the identity of the user, such as Windows account information, and that user s roles. It also contributes to the code s capability to impersonate.

• Authentication and authorization can be controlled by the application itself or rely on external authentication methods, such as NTLM and Kerberos. Once Windows has authorized a user to execute CLR-based code, the code has to control all other authorization that is based on the identity of the user and information that comes with assemblies, called evidence.

• Security policy controls the entire CLR security system. A system administrator can build policies that grant assemblies permissions access to protected resources and operations. This permission granting is based on evidence that the assemblies hand over to the CLR. If the rules that make up the security policy are well constructed, they enable the CLR to provide a secure runtime environment.

• Type safety is related to the prevention of assembly code to reach into memory/storage of other applications. Type safety is always checked during JIT compilation and therefore before the code is even loaded into the runtime environment. Only code that is granted the Skip Verification permission can bypass type safety checking, unless this is turned off altogether.

Code Access Security

• Code access security is based on granting an assembly permission and enforcing that it...