We had a major server compromise over the christmas period when a comprimised FTP account was used to upload a .net back door which gave it access to the entire asp.net machine account and comprised dozens of e commerce stores.
We disabled the comprimise and cleaned up the mess, but I want to put a stop to this. Doing my research, it appears that limiting .net applications to medium (not full trust) will ensure applications keep themselves to themselves and cannot interact under normal circumstances.
However since our application is classic ASP and .NET, there's little use securing .net unless I can secure the ASP too.
Does anyone know what additional security I might need to implement in order to secure ASP in a similar fashion?