Recongized poor configurations involving the Web.config

I am trying to put together a document for my developer team that lists risky security configurations in the web.config. 

For example, changing the <forms> element attribute protection="None" code be a base idea 

If you have a good resource links please include it in your response.

 Thanks!
...