Security

ASP.NET security is a huge topic and we're only scratching the surface.  Let's continue to categorize in the add new content around security to make this a great resource. This is just the overview page, make sure to visit the subpages from the Table of Contents or scroll down.

Webcasts/Videos

• Web Application Security with Keith Brown - In this installment of geekSpeak, security guru Keith Brown discusses how you can address security concerns in your Web applications.
• Securing your Web Site with Membership and Login Controls - This video explores the new membership capabilities of ASP.NET 2.0. In addition, you will learn about role-based security, and how you can use roles to control access to your web site.
• Using Code Access Security and Partial Trust with ASP.NET - Attend this webcast to discover one of the most overlooked security features of Microsoft ASP.NET, code access security (CAS).
• ASP.NET: Security Tips & Tricks for ASP.NET Developers - In this webcast we’ll example several application security development patterns from the trenches that will help you build applications that are better at thwarting the bad guys.
• Best Practices: A Look at Developer ASP.NET AJAX Security Mistakes - This talk will discuss and demonstrate the security pitfalls common in ASP.NET AJAX development.
• Dave's Top 10 Ways to Secure Your Web Application - Level 300 - Practical best practices for writing secure ASP.NET code.
• MSDN "How Do I?" Security videos - Includes a variety of ASP.Net-related security videos.

Blogs

• Arno Nel's Ultimate Security List - Arno has put together an amazing list of links to resources you can use covering security, roles, membership, and the profile provider within ASP.NET. This is a great place to start.
• ASP.NET 2.0 Security Training Modules - Bgold has some excellent links including labs on Input and Data Validation.
• ScottGu's Blog's Security Category - Everything The Gu has ever blog about Security.
• Top 5 Application Security Vulnerabilities in Web.config Files - Sanjeev with a fine list focused on web.config vulnerabilities.
• Basics of Authentication - An older article, but good overview.
• ASP.NET Security Forums - Engage with your fellow developers and talk security.
• KB: ASP.NET Security Overview - Recently updated, this KB article is full of links and pointers to other articles that will come in handy depending on which authentication scheme you decide to use.
• Introduction to the Provider Model - Much of the security model and a ASP .net 2.0 is managed by a design pattern called the Provider Model.  This design pattern may be unfamiliar and this article is a good overview. You can also download the entire series as a PDF.
• Use less code to secure ASP.NET applications - Usually, the less you write the less there is to break into. 
• ASP.NET Forms authentication and impersonation - An ASP.NET class and accompanying control for providing application support users with a 'login as user ...' function the right way.

Articles

• Building Secure ASP.NET Applications: Authentication, Authorization, and Secure Communication - MS Patterns and Practices Team
  This guide presents a practical, scenario-driven approach to designing and building secure ASP.NET applications for Windows 2000 and .NET Framework version 1.0. It focuses on the key elements of authentication, authorization, and secure communication within and across the tiers of distributed .NET Web applications.
• Web Service Security Guidance
  Provides architectural, design, and implementation guidance for applying security to Web services by using Web Services Enhancements (WSE) 3.0 and the .NET Framework 2.0. Includes scenarios, patterns, decision matrices, and QuickStarts to help you make the most appropriate decisions based on your solution’s requirements.
• Security Guidance for .NET Framework 2.0
  This page provides an index to the patterns & practices Security Guidance for .NET Framework 2.0 project. You can use the guidance to improve both the security of your applications and your approach to building secure applications.
• Scott Mitchell's Security Tutorial Series on ASP.NET
  A new tutorial series by Scott Mitchell of 4GuysFromRolla.com on ASP.NET security, roles, and membership, in the style of his well-known Data Tutorial series.
• Cryptography Application Block  - MS Patterns and Practices Team
  The Cryptography Application Block is a component of Enterprise Library which makes it easier to include cryptographic functionality in .NET applications. The block provides a simple interface to DPAPI, symmetric encryption and hashing, and uses the Enterprise Library configuration tool to simplify key management.

Enjoy!

You must Login to comment.