Developing More-Secure Microsoft ASP.NET 2.0 Applications

by Baier, Dominick

• ISBN13: 9780735623316
• ISBN10: 0735623317
• Edition: 1st
• Format: Paperback
• Copyright: 2006-09-27
• Publisher: Microsoft Press

Summary

Get hands-on, expert guidance for developing more secure Web applications with ASP.NET 2.0 with this in-depth reference. The nature of the Web and its underlying communication protocols make Web applications harder to secure and, therefore, primary targets for hacking attacks and other kinds of compromises. This book guides you through the possible vulnerabilities of Web-based applications and shows you how to help mitigate them in your own applications. Start with the ingredients of security-enhanced Web applications from the ground up, beginning with Web server set-up, and learn how to harden that machine for a potentially hostile environment such as the Internet. Then move on to in-depth treatment of crucial topics such as how to use ASP.NET to perform proper input validation; choosing from the numerous options for authenticating and authorizing users; how to store application-related and user-related sensitive data in a secure fashion; how to incorporate detection; and error logging measures. This guide covers how to integrate ASP.NET into the Microsoft Windows- security infrastructure and how to effectively use impersonation, delegation, and Active Directory- directory service. You will also learn about new Microsoft Windows Server 2003 features, such as constrained delegation and protocol transition. Coverage extends to one of the most underutilized features of ASP.NET--running in partial trust. The book concludes with guidance on how to conduct audits and penetration tests and how to integrate them in the development process. Written by a leading authority and trainer, this reference comes complete with best practices based on real-world experience and extensive code samples in C#.

Author Biography

Dominick Baier splits his time between being an independent security consultant and an instructor for DevelopMentor - teaching and authoring the ASP.NET and the .NET security curriculum. He has a degree in computer science (German Diplom Ingenieur), is a certified BS7799/ISO17799 Lead Auditor and speaks at various conferences (WinDev, DevWeek, ADC) about application security. When not teaching he spends his time researching security, doing audits and penetration tests and helps other developers around the world to build more secure applications. Dominick maintains a security blog at http://www.leastprivilege.com.

Table of Contents

Web application security	p. 1
ASP.NET 2.0 architecture	p. 9
Input validation	p. 23
Storing secrets	p. 71
Authentication and authorization	p. 121
Security provider and controls	p. 209
Logging and instrumentation	p. 261
Partial trust ASP.NET	p. 307
Deployment and configuration	p. 347
Tools and resources	p. 373
Building a custom protected configuration provider	p. 401
Session state	p. 405
Compartmentalizing ASP.NET applications	p. 413
Secure Web services	p. 421
Unit testing Web applications using visual studio team edition	p. 425
Table of Contents provided by Blackwell. All Rights Reserved.