Browse by Tags

• AJAX
• Auditing and Logging
• Authentication
• Deployment Inspection
• Deployment Phase
• Development Phase
• IIS 7
• Implementation
• Performance
• Practices
• Sensitive Data
• Test Phase
• Threat Modeling

Securing IIS7 - Windows Server 2008 Security Guide

Windows Server 2008 Security Guide is out. It covers many crucial aspects but my favorite of course is IIS7 chapter: Chapter 6: Hardening Web Services This chapter provides prescriptive guidance for hardening the Web Server role. The chapter discusses Read More...

Posted 28 February 08 07:09 by alikl | 1 Comments   
Filed under Security, Deployment Phase, Deployment Inspection, IIS 7, Planning Phase

Chain Of Responsibility Design Pattern – Focus On Security, Performance, And Operations

The pattern is also called Intercepting Filter, Pipeline, AOP, and may be few more… I am confused by the name for this design pattern. “Life is really simple, but we insist on making it complicated.” - Confucius No matter how they call Read More...

Posted 14 January 08 03:50 by alikl | 1 Comments   
Filed under Security, Implementation, Performance, Planning Phase

ASP.NET 3.5 Extensions: Basic Steps To Create Dynamic Data Web Application - Focus On Security and Performance

This post walks through the steps I've taken to create simple Dynamic Data Web Application. I just loved the development model for DTO [Data Transfer Object] and Input Validation options. Summary of steps Step 1 - Download and install ASP.NET Extensions. Read More...

Posted 18 December 07 10:08 by alikl | 1 Comments   
Filed under Security, Development Phase, Implementation, Performance, Planning Phase, AJAX

Avoid Manipulating Passwords In Memory - It Is Easy To Reveal

Revealing clear text passwords in memory seems to be a trivial task. This post describes how to reveal clear text passwords and what countermeasures to apply. Summary of steps: Install WinDbg Attach to process or open dump file Load SOS .Net extensions Read More...

Posted 08 December 07 05:55 by alikl | 3 Comments   
Filed under Test Phase, Security, Sensitive Data, Authentication, Planning Phase

Authentication And Identity Flow When ASP Page Consumes ASP.NET Web Service

"Classic" ASP has application isolation that is different from ASP.NET. Here is one of the real world scenarios where it might matter. There is a legacy web application written in ASP and hosted on Win2K3 box (IIS 6.0). It is of course in the process Read More...

Posted 05 September 07 05:04 by alikl | 4 Comments   
Filed under Security, Deployment Phase, Authentication, Planning Phase

Web Services Over SSL - Is It Really That Slow Like They Say?

My answer is "no" . I am working on solution where there is no Windows Active Directory Domain so we cannot utilize our beloved Kerberos and Windows Integrated Authentication saving big on configuration and management while taking advantage of increased Read More...

Posted 01 August 07 03:35 by alikl | 2 Comments   
Filed under Security, Development Phase, Implementation, Deployment Phase, Performance, Authentication, Planning Phase

Man-In-The-Middle-Attack: Protecting Http Traffic With SSL Might Be Not Enough - Consider Protecting SQL Traffic Too

Think configuring SSL for your web site is enough to protect against prying eyes? Here is how the sensitive data can be exposed by sniffing your SQL traffic. Consider common simple 3 tier web architecture for data driven web site. The Web and DB server Read More...

Posted 30 July 07 03:06 by alikl | 1 Comments   
Filed under Security, Implementation, Deployment Phase, Planning Phase

Typed DataSet - Potential Performance And Security Risk

Are you using Typed DataSet as DTO (data transfer object) ? Are you building distributed systems where the DTO goes back and forth including your Smart Client? If yes then I think you should be aware that the most of your DB schema can be easily revealed Read More...

Posted 06 July 07 09:49 by alikl | 4 Comments   
Filed under Security, Development Phase, Implementation, Performance, Planning Phase

ASP.NET Health Monitoring Means Logging And Auditing

I constantly keep seeing ASP.NET developers using log4net for logging and auditing their Web apps. While I have nothing against log4net - it is great stuff I presume though never used it - it is pretty funny to me to get why people do not use built-in Read More...

Posted 02 May 07 07:35 by alikl | 5 Comments   
Filed under Security, Development Phase, Auditing and Logging, Planning Phase

Threat Modeling Big Chunks

When three years ago I started to practice Threat Modeling I thought it is most boring part of security (which itself is not the most fascinating thing to most of people). I hated it since it seemed too boring - interview folks, read tones of specs, and Read More...

Posted 27 April 07 07:34 by alikl | 7 Comments   
Filed under Security, Practices, Planning Phase, Threat Modeling

Search

This Blog

• Home
• Email