c# - Memory Heap Security: String garbage collection -

i have been doing security code review company , using tool called fortify360. identify many issues code , describe problems. interesting issue has raised have not found other info on following:

"sensitive data (such passwords) stored in memory can leaked if stored in managed string object. string objects not pinned, garbage collector can relocate these objects @ , leave several copies in memory. these objects not encrypted default, can read process' memory able see contents. furthermore, if process' memory gets swapped out disk, unencrypted contents of string written swap file. lastly, since string objects immutable, removing value of string memory can done clr garbage collector. garbage collector not required run unless clr low on memory, there no guarantee when garbage collection take place. in event of application crash, memory dump of application might reveal sensitive data."

all of understand make sense , in research of issue pretty standard.

the question is: how solve issue? suppose class or classes in question cannot inherit idisposable(very large app, , class needed long after string in question). there alternate way of manual memory management dispose of specific string without calling garbage collector, gc.collect()??

appreciate in advance.

alex

if want avoid need use system.securestring, idisposable, hold sensitive data, holding onto minimum possible time required.

it's kind of ironic msdn sample code not dispose instance, either explicitly or using encapsulation.