How does the code encrypt secrets?
Verify that the code uses DPAPI to encrypt connection strings and credentials. Do not store secrets in the Local Security Authority (LSA) because the account used to access the LSA requires extended privileges. For information on using DPAPI, see “How To: Create a DPAPI Library” in the “How To” section of Microsoft patterns & practices Volume I, Building Secure ASP.NET Applications: Authentication, Authorization, and Secure Communication or How To: Encrypt Configuration Sections in ASP.NET 2.0 Using DPAPI. • Does the code store secrets in the registry? If the code stores secrets in HKEY_LOCAL_MACHINE, verify that the secrets are first encrypted and then secured with a restricted ACL. An ACL is not required if the code stores secrets in HKEY_CURRENT_USER because this registry key is automatically restricted to processes running under the associated user account. • Does the code eliminate secrets from memory? Look for failure to clear secrets from memory after use. Because the common lan
