Developing secure .NET applications |
 |
| 20 Mar 2006 | SearchSoftwareQuality.com |
|
|
 There's no denying the importance of incorporating security at the application level. While some issues are similar across platforms, .NET developers face their own challenges. The resources here will help you understand the basics of .NET application security. In addition, you'll learn about tools to help you secure your code, sample code for you to use and resources to get even more information if you need it.
Are there other topics you'd like to see learning guides on? Send me an e-mail and let me know what they are. -- Michelle Davidson, Editor.
 .NET Security Basics | |
[Return to Table of Contents]
- Secure SDLC: Integrating security into your software development life cycle: The first step for boosting application security is integrating security into the SDLC. This detailed tip includes thorough instructions for adopting security measures into your development process.
- Application security with ASP.NET: Web application security is easier once you understand how to utilize the security features built in to ASP.NET. This article explains how to find and use those features.
- Is .NET less vulnerable to security hacks?: Expert Caleb Sima explains how to prevent two common exploits, cross-site scripting (XSS) and SQL injection in .NET applications.
- Comparing Java and .NET security: Lessons learned and missed (PDF): This detailed paper outlines the security features of both .NET and Java and where improvements can be made.
- No clear winner in .NET/J2EE security race
: Both platforms have the same kind of security model, this article explains. However, there are a few differences software developers should be aware of.
- ASP.NET Web Application Security: Thorough, organized site with tips on .NET basics, authentication, authorization and more.
- ASP.NET Web application and Windows authentication –- a case study: The article explains how to secure user permissions using, specifically, "Integrated Windows Authentication."
- Security practices: ASP.NET 2.0 security practices at a glance: This white paper from the Microsoft Developer Network (MSDN) explains how to implement code access security, authorization, validate input and more.
| .NET Security Features & Mechanisms | |
[Return to Table of Contents]
| .NET Threats and Vulnerabilities | |
[Return to Table of Contents]
- Threat modeling Web applications: From MSDN, an intensive tutorial on threat modeling and how to apply it to your Web applications.
- Threat modeling enhanced with misuse cases: Proper threat modeling, especially when boosted with misuse cases, can prevent many common and serious application exploits such as SQL injection, brute force attacks and sniffing attacks.
- Secure Coding Practices for Microsoft .NET Applications, 2003 (PDF) : This white paper by Amit Klein addresses common ASP.NET security vulnerabilities such as parameter tampering and SQL injection and offers coding solutions for them.
- Guarding against XSS in ASP.NET: Preventing cross-site scripting attacks in .NET applications is similar to XSS prevention on other platforms. However, there are security features in .NET that boost security against this exploit.
- SQL injection: Developers fight back: Anurag Agarwal provides 10 steps for preventing this common application security attack. Input validation is explored in further detail, and code samples are included.
OWASP resources
Here is a list of tutorials from the Open Web Application Security Project, commonly known as OWASP. Each of these chapters is from the OWASP Guide to Building Secure Web Applications and Web Services.
| .NET and Web Services | |
[Return to Table of Contents]
| .NET Security Tools | |
[Return to Table of Contents]
| .NET Security Code Samples | |
[Return to Table of Contents]
| Other Useful Resources | |
[Return to Table of Contents]
|
|
|
|
Expert advice on .NET security
