Secure downloadable PDF files

[Alpine7]

I would like to know the best place to store pdf files for download. I am
looking for a high level explanation not a detailed how to.

The files are user specifice information and I know I can create folders on
my web server and store the files there then secure each folder using the
web.config file. The app could then loop through the directory based on the
users login and display the pdf files and if this users ID is granted access
via the web.config in that folder then he could download the files if I have
set up the proper application extentions.

if the web server lives in the perimeter network then storing all the files
on the server seems somewhat insecure. If I store the path to the files on
the sql server and keep the files behind the firewall won't i have to punch a
whole in my firewall so the files can be accessed by the web server and if so
doesn't this pose a security risk. Can I use ISA to solve this problem and if
so how.

Any ideas would be appreciated.

 

[Eugene Mayevski]

if the web server lives in the perimeter network then storing all the

files
on the server seems somewhat insecure.

....Unless the files are protected in the way that picking them is useless.
For example, if you encrypt the files with a user password (and don't store
the password), then this would be quite secure.

To manage files easier we offer Solid File System (
http://www.eldos.com/solfs/ ), which is a virtual file system oriented on
storing documents and document metadata.

 

[Chakravarthy]

I recommend a restricted folder to contain all the files to download and
design an interface to have the authentication enforced

HTH