What's the best practice for securing a file on an IIS 7 web application running on Windows 2008 server?
I have the following requirements and ideas:
Requirements: A authenticated user to my web app will click on a button that will create a file with data from my database. This file is sensitive and can't be downloaded. Someone with server access will be able to go and view it if necessary on the server folder.
Ideas: I create a folder on the server say C:\MyRecords. Inside that folder I used only allow what type of access? Just write and read? I should then use windows to authenticate the directory correct?
Any ideas would be appreciated.