Summary

This chapter covered how assemblies are matched to code groups, and how those code groups are assigned permissions by the security policy at the user, enterprise, and machine levels, and you saw how you can use tools to manage this policy. You learned how, for an assembly to execute, it must have the relevant permissions at the three policy levels, as well as the correct role-based permissions and the relevant Windows account permissions. You also looked at the options available to you in distributing code using strong names and digital certificates.

Clearly, there are more security checks in place with .NET than you have seen before on Windows, and much of the security comes “for free” because you needn’t do much to make use of it at the basic level. However, when you want to extend it, you are provided with the classes and frameworks to do that.

Security is an ongoing challenge, and although Microsoft has not solved all the problems, the managed security environment provided by .NET is a significant step in the right direction because it provides a framework within which code is challenged before it executes. It’s no coincidence that these developments are occurring at a time when Microsoft is moving toward distributing its products over the Web.