title: secure one or more config files on your server
body: <p>We are trying to fix a deployment / security issue at work. I would like to take our database connection strings out of our application web config files and move them up a layer or two in the web config file hierarchy. To the root / global or even machine config file. This way they are no longer going to be transformed and there's no risk of deploying the wrong connections to the wrong environment. These settings now live on the machine and there is only one copy of them for each and operations can own them. However our network admin doesn't want to take this approach because as you move these settings up the config chain you provide more access to them on the whole. If they are at an IIS level then all the websites can then access that information if they are at a machine level then any application on the machine can access them and if one of those applications is compromised then potentially those databases could be compromised as well. He wants to ensure that only the specific applications or the specific accounts that have access to those settings can get at those settings. </p>
  
  <p>Is there a way for me to move those connection strings into one of the other config files on the machine but still ensure that only the particular applications have access to the required connection strings or settings. </p>
  
  <p>I am aware that this might not be the best location for this question. Or perhaps it could be phrased better. If either are true please let me know where to put the question or how to phrase it in order to get a better answer. </p>
  
  <p>I have done some googling but the documentation doesn't quite seem to help with my specific questions or maybe I don't know enough to perform my search correctly. The following is an example of a link that I found ... <a href="http://msdn.microsoft.com/en-us/library/89211k9b(v=vs.110).aspx" rel="nofollow">http://msdn.microsoft.com/en-us/library/89211k9b(v=vs.110).aspx</a> </p>
  
  <h1>UPDATE</h1>
  
  <p>The crux of the matter is that I am hoping that you can somehow have application specific access to an xml element of one of those other config files. That there might be some properties that we can add and then only specific applications can see those elements (connection strings) even though they will all be in the machine config or the global config etc...</p>