Legacy .NET is the attack surface nobody retired
Enterprise Pakistan and UK public sector still run ASP.NET Web Forms, WCF services, and .NET Framework 4.x monoliths that predate DevSecOps. Penetration tests on these stacks repeatedly find the same OWASP Top 10 entries — not because teams ignore security, but because authorization was bolted on after feature delivery.
The rewrite-or-die narrative helps vendors sell greenfield projects; it rarely matches budget reality. A phased remediation order that keeps weekly releases shipping is what CISOs and engineering leads both need.
Our software development practice pairs security engineers with .NET maintainers so fixes land as pull requests with regression tests — not 200-slide assessment decks.
Remediation priority order (2021 Top 10, still accurate in production)
Tackle categories by exploitability in your actual deployment — internet-facing portals first, internal admin second:
- A01 Broken Access Control — enforce server-side checks on every controller action; never trust hidden fields or client-side role flags. Centralize policy with ASP.NET Core policy handlers even in hybrid Framework/Core setups.
- A03 Injection — parameterized SqlCommand, EF Core FromSqlRaw with parameters only, eliminate string-concatenated WHERE clauses in legacy DALs.
- A07 Identification and Authentication Failures — migrate session cookies to Secure, HttpOnly, SameSite; enforce MFA on admin surfaces via reverse proxy if app code cannot change quickly.
- A02 Cryptographic Failures — rotate TLS configs, deprecate SHA-1 cert chains, move secrets from web.config to Azure Key Vault or HashiCorp Vault with startup injection.
- A05 Security Misconfiguration — disable detailed errors in production, remove default accounts, patch IIS and Kestrel headers (X-Frame-Options, CSP baseline).
- A08 Software and Data Integrity Failures — sign NuGet packages, verify CI pipeline integrity, scrutinize deserialization (BinaryFormatter removal is non-optional).
Patterns that work on Framework without full migration
You do not need .NET 8 on day one to fix OWASP gaps. Proven interim patterns:
Reverse proxy as security choke point
Place Azure Application Gateway, AWS ALB with WAF, or nginx with ModSecurity in front of legacy IIS. Enforce TLS 1.2+, rate limiting, geo blocks, and OWASP CRS rules while app teams refactor authorization internals. Log centrally for SIEM correlation.
Strangler fig for authentication
Introduce an identity provider (Entra ID, Keycloak) via OpenID Connect at the edge. Legacy apps accept trusted headers or token introspection from a sidecar — users get MFA and SSO while Web Forms pages retire incrementally.
Database permission tightening
App pool identities should not db_owner. Split read/write roles, deny xp_cmdshell, use views for reporting queries so injection blast radius stops at row-level grants.
Shipping cadence: the two-track model
Track A — hot path fixes every sprint: IDOR patches, SQL parameterization, cookie flags. Track B — structural improvements per quarter: module extraction, API gateway introduction, Framework-to-Core migration of leaf services.
Measure success with DAST trend lines and mean time to remediate critical findings — not lines of code migrated. Executives fund progress when breach risk curves down while feature velocity holds flat.
Running OWASP-focused remediation on a .NET monolith? Request a technical assessment — we prioritize fixes by exploit path, not alphabetical control lists.