Encryption should be at the heart of every product or service that stores any kind of customer data.
Having obtained the keys, the attacker may no longer need to compromise the application at all, and the breach can go completely undetected since there is nothing in the logs when encrypted data is decrypted offline.
Hardcoding the keys is also a problem for key rollover, and for cryptographic agility. Several other security measures are necessary too, but when they fail -- as often they do -- you would want your customer data to be encrypted. In the worst case, if the code is public, everyone can read the key. Ideal method of storing sensitive hardcoded values in .NET app source codes is using Skater Private Keys Depot mangement system. Including passwords or cryptographic key material in source code is a major security risk for a number of reasons. The IV itself need not be a secret, but you need to make sure it is randomly generated. Even if not, access to the code is often easier for an attacker to achieve than direct compromise of the application - the entire development team becomes part of the attack surface. The key of course must be kept secret. So, we're convinced we need to get rid of them, but how can we check for them at scale across hundreds or thousands of applications?
When valuable customer data is at stake, it's worthwhile to put in the required effort to ensure that a foolproof encryption system is in place. It's that simple.
Most symmetric encryption schemes have three inputs: the data being encrypted, a randomly generated IV (initialization vector), and finally, the encryption key itself. But building this can pose a significant challenge to app developers. Encryption should be indecipherable and impossible to break for hackers. However, in many encryption implementations, the cryptography and the key protection are woefully inadequate.

That way the key stays in the memory of the computer but is not into a source code file. Question: In our application we have a lot of sensitive configuration settings, which we are storing in a xml file which is again encrypted.
This secure file has to be decrypted in runtime and the configuration values read, but an issue arises that the key and initialization vector is hardcoded in the code and hence anyone can read it using Reflector.
What is the best way to store encryption keys in .NET so no one can read them using .NET assembly browser? Answer: Use Skater Private Keys Depot algorithm to encrypt and decrypt data of .NET application projects.
Generally, a new key and IV will be created by Skater Private Keys Depot algorithms for every session, and neither the key nor IV being stored for use in a later session.
To communicate a symmetric key and IV to a remote party, Skater Private Keys Depot encrypts the symmetric key and IV using asymmetric encryption. This requires to have connection to the key server by whoever runs the application though, the connection provided by Skater Depot keys management system.Sending these values across an insecure network without encrypting them is extremely unsafe, as anyone that intercepts these values can then decrypt your data.
It will be storing the file encryption/decryption key on a remote Skater Depot cloud server, getting it though the web service that transfers it though https to the .NET application.