TickYouOff
Sign in
Back
🔒

Microsoft .NET Framework 4 Security Checklist

Medium 15 items · 2 hours
testuser's avatar
testuser Published 4 months ago
Security

This checklist helps IT administrators and general users verify secure configuration of Microsoft .NET Framework 4.0 using DISA STIG guidance and best practices. Use it to patch, harden configs, run automated scans, and maintain ongoing audits for managed environments.

Source: https://ncp.nist.gov/checklist/432

Progress
0 / 15
  1. Download DISA SCAP and XCCDF content for .NET 4 STIG — Get SCAP 1.3 and XCCDF packages from DISA for automated benchmarking.
  2. Run automated SCAP/SCC benchmark scan using XCCDF — Use SCC or your SCAP tool to evaluate hosts against the .NET 4 STIG.
  3. Update .NET Framework 4 to latest security patches — Apply Microsoft's cumulative updates and security fixes for .NET 4.x.
  4. Scan and inventory hosts running .NET Framework 4.0 — Create an asset list of servers and workstations with .NET 4 installed.
  5. Uninstall or disable unused .NET components and legacy versions — Remove deprecated runtimes and features not required by applications.
  6. Review and harden machine.config and web.config — Check global and app configs for insecure defaults and debug settings.
  7. Remove debug and compilation debug settings — Ensure <compilation debug="false"> is set in production configs.
  8. Set customErrors to 'On' and configure error pages — Prevent detailed stack traces from being exposed to end users.
  9. Enforce appropriate trust levels and remove unnecessary fullTrust — Limit application trust and remove overly permissive policies.
  10. Enable strong cryptography (SchUseStrongCrypto) for .NET 4 — Set registry/machine.config flags to prefer TLS 1.2+ and strong ciphers.
  11. Enforce Code Access Security policies and disable unnecessary evidence — Harden CAS and reduce reliance on evidence-based trust where possible.
  12. Restrict assembly loading and verify assemblies are signed — Prevent untrusted assemblies by enforcing strong name and signature checks.
  13. Configure CLR and application logging and forward to SIEM — Enable .NET runtime, application errors, and security event forwarding.
  14. Backup .NET configuration files and document accepted exceptions — Store machine.config, web.config and change justifications in version control.
  15. Schedule regular audits and baseline comparisons for .NET security — Run periodic STIG scans and track deviations from the secure baseline.
Sign in to save
📝 My Notes