Question: I'm not a web-app guy but I'm the only one at my work that raised any objections about giving full permissions to the (anonymous) INETUSER account for the purposes of running an ASP.NET web-app in IIS. That's read, write, execute, special permissions, etc, for a webapp that reads (the db connection is read-only) from a SQL database. I'm thinking that this might not be the smartest choice for keeping the server secure.

Because I said, "hey, this might be a terrible idea," I was asked to do a risk assessment. Like I said, I basically have no knowledge of ASP.NET or web apps in general, but without knowing intimate details of the setup, can you guys tell me what kinds of issues should I be looking at here?

I'm a bit scared to give the anonymous internet user account FULL Permissions for the wwwroot\ directory.

Thanks for any help; I'm just looking for the big-ticket problems that are apparent to those more educated than me.

Any ideas?

Answer: 
Presumably, you are giving INETUSER account write access because you have some mechanism to write/upload to wwwroot. The threat I see is the possibility of the user uploading arbirtrary code (new aspx's, .dlls) to the server, which would grant them the ability to do anything.
The article [Secure Content in IIS Through File System ACLs](http://learn.iis.net/page.aspx/583/secure-content-in-iis-through-file-system-acls/) could be of your interest. You should highlight `Avoid full control, and use more granular read/write permissions.`

You can also refer [IIS 6.0 Security Best Practices (IIS 6.0)](http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/596cdf5a-c852-4b79-b55a-708e5283ced5.mspx?mfr=true) and [Security in IIS 6.0](http://technet.microsoft.com/en-us/library/cc757698(WS.10).aspx).