Essential .NET, Volume 1: The Common Language Runtime

Where Are We?

The CLR supports a component-centric security model known as code-access security. Code-access security assumes that each assembly can provide evidence as to its origins, both in terms of who wrote the code and where it was downloaded from. Code-access security uses a configurable security policy to grant permissions to code based on evidence. Although the CLR implicitly enforces some aspects of security policy, it is the job of trusted libraries to enforce security explicitly, using either imperative programmatic interfaces or declarative attributes.