Developing More-Secure Microsoft® ASP.NET 2.0 Applications

Get hands-on, expert guidance for developing more secure Web applications with ASP.NET 2.0 with this in-depth reference. The nature of the Web and its underlying communication protocols make Web applications harder to secure and, therefore, primary targets for hacking attacks and other kinds of compromises. This book guides you through the possible vulnerabilities of Web-based applications and shows you how to help mitigate them in your own applications. Start with the ingredients of security-enhanced Web applications from the ground up, beginning with Web server set-up, and learn how to harden that machine for a potentially hostile environment such as the Internet. Then move on to in-depth treatment of crucial topics such as how to use ASP.NET to perform proper input validation; choosing from the numerous options for authenticating and authorizing users; how to store application-related and user-related sensitive data in a secure fashion; how to incorporate detection; and error logging measures. This guide covers how to integrate ASP.NET into the Microsoft Windows® security infrastructure and how to effectively use impersonation, delegation, and Active Directory® directory service. You will also learn about new Microsoft Windows Server™ 2003 features, such as constrained delegation and protocol transition. Coverage extends to one of the most underutilized features of ASP.NET—running in partial trust. The book concludes with guidance on how to conduct audits and penetration tests and how to integrate them in the development process. Written by a leading authority and trainer, this reference comes complete with best practices based on real-world experience and extensive code samples in C#.

Dominick Baier leads the security curriculum at DevelopMentor, including teaching and authoring courses about .NET, ASP.NET, WinFX®, and Microsoft Windows Vista™ security. He holds a degree in computer science, is a certified BS7799/ISO17799 Lead Auditor, and speaks at various conferences around the world about application security. When he’s not teaching, Dominick spends his time researching security, performing audits and penetration tests, and helping other developers around the world build more secure applications. Dominick is a Microsoft MVP for "Visual Developer—Security" and hosts a popular blog.