Securing web.config settings

Question

We are developing an ASP.NET MVC 5 application. We hired some remote developers to help us with the project.

The web.config file contains connection strings and app settings that we don't want to share with these remote developers. To work on our application, these developers remote into a development desktop that we control.

What is the best practice for securing sensitive information in web.config, so that developers can still run and debug application but not read the sensitive info in web.config?

Answer 1

Encrypting the web.config in a development environment is pointless. The only way to truely hide the information from the developers is not to give it to them in the first place.

1. You must ensure that your "remote development environment" is setup only to access a development database and is configured with other development settings only.
2. Don't check in any sensitive data (production passwords, etc) into your source control. You can achieve this by separating the information into external .config files so they are not checked into source control. TIP: Ignore the file with the actual passwords and add another one with the same name and an extension such as .config.example that is checked in to give the developer instructions on how to setup the file on their local system (which is a helpful reminder regardless of who sets up the system from a clone of the source control repository).
3. Use a continuous integration server (TeamCity, Jenkins, Octopus Deploy, etc) to build sensitive information into the release workflow through environment variables. Many CI servers have the ability to hide sensitive data from the UI. You can either practice automatic deployment via CI button-click so your developers don't have access to the sensitive data that is in the CI server, or give the deployment artifact(s) to a trusted team to install in production.

There is really no reason why a developer should even be given a chance to see sensitive production data such as passwords and private keys.

Answer 2

Like Ingenioushax suggested, the standard way of encrypting sections of web.config is using aspnet_regiis. Here is a tutorial.