Extra Defensive Measures

Here are a small number of useful defensive layers to add to your applications:

• Use encryption properly to store sensitive information, and signing to mitigate tampering threats when you cannot set strict ACLs.

• Use ACLs or permissions to restrict who can access (read and write) secret data if it must be persisted .

• Scrub the memory securely once you have finished with the secret data. This is often not possible in languages such as Java, or in Managed Code. However, .NET 2.0 adds the SecureString class to alleviate the issue.