Browse by Tags

• AJAX
• Architecture
• Auditing and Logging
• Authentication
• Authorization
• CardSpace
• CAS
• Code Inspection
• Consulting
• Deployment Inspection
• Deployment Phase
• Development Phase
• End User
• Fuzzing
• IIS 7
• Implementation
• Inception Phase
• Information Gathering
• Input Validation
• Performance
• Planning Phase
• Practices
• Reflection
• Sensitive Data
• Test Phase
• Threat Modeling
• Tools
• Vista
• WCF

ASP.NET Security Architecture Cheat Sheet For Very Busy Architects

      You are an architect. You are sitting in your fancy office thinking about cloud computing and about the higher ground stuff. Suddenly the phone rings, it's your current project manager. "Quick! Come over here, we have a Read More...

Posted 19 March 09 12:20 by alikl | 2 Comments   
Filed under Security, Architecture

Consulting And Security Reviews - How To Get Everyone Onboard

      Security reviews are a respected methodology.  People know about them, and probably use them semi-regularly. Ask anyone if security reviews are important, and they would all say yes.  Ask them if they do it regularly, Read More...

Posted 24 November 08 08:56 by alikl | 9 Comments   
Filed under Security, Practices, Consulting

Security Code Review – String Search Patterns For Authorization Vulnerabilities

These are the questions and the search criteria I use to identify authorization vulnerabilities in the code beyond web.config <authorization> node. How does the code protect access to page classes? Attributes Search for PrincipalPermission attributes. Read More...

Posted 24 July 08 10:53 by alikl | 1 Comments   
Filed under Test Phase, Security, Authorization

Security Code Review – String Search Patterns For Authentication Vulnerabilities

This post contains string search patterns that can help identifying authentication vulnerabilities during security code inspection for your ASP.NET application . Most common vulnerability is about insecurely manipulating credentials in the code. The question Read More...

Posted 21 July 08 03:39 by alikl | 0 Comments   
Filed under Test Phase, Security, Authentication

Security Code Review – String Search Patterns For Finding Input Validation Vulnerabilities

Well defined set of search patterns helps significantly reduce time (cost) when performing security code inspections. This post focuses on input validation vulnerabilities commonly found in ASP.NET web applications. SQL Injection and Cross Site Scripting Read More...

Posted 11 July 08 02:24 by alikl | 2 Comments   
Filed under Input Validation, Test Phase, Security, Tools

patterns & practices Improving Web Services Security: Scenarios and Implementation Guidance for WCF - BETA Is Out

patterns & practices team has just released a beta version of WCF Security Guide on Codeplex. Download the guide at http://www.codeplex.com/WCFSecurityGuide . Original announcement by J.D. Meier, the man behind the effort, is here - New Release: patterns Read More...

Posted 05 June 08 04:57 by alikl | 1 Comments   
Filed under WCF, Security, Practices

WCF Security - Input/Data Validation Using Schemas

WCF offers very flexible approach of Input and Data Validation based on XML Schemas. The approach is flexible since the validation rules are expressed in form of XML schema and can be changed at any time without recompiling the solution. I followed the Read More...

Posted 25 May 08 03:52 by alikl | 1 Comments   
Filed under WCF, Input Validation, Security, Development Phase, Implementation

WCF Security - Input/Data Validation Sample Visual Studio Project

Input and Data Validation is one of the core security principles . WCF is no exception . To get most out of WCF in secure way one must implement proper Input and Data Validation. I was following instructions on How To – Perform Input Validation Read More...

Posted 25 May 08 12:17 by alikl | 1 Comments   
Filed under WCF, Input Validation, Security, Development Phase, Implementation

patterns & practices WCF Security Guidance Project - live on Codeplex

patterns & practices has recently released WCF Security Guidance Project . JD , the program manager behind the effort, has been blogging about it too.It is evolving project but the initial content is fantastic already. It has Application Scenarios Read More...

Posted 02 April 08 08:53 by alikl | 1 Comments   
Filed under WCF, Security, Development Phase, Implementation, Practices

Quickly Find And Fix Cross Site Scripting (XSS) Vulnerabilities In Your ASP.NET Application.

Want to quickly check your ASP.NET Web application for Cross Site Scripting (XSS) vulnerability ? It is pretty easy with the knowledge and tools you already have. This post describes how to quickly find and fix most of XSS vulnerabilities in your code. Read More...

Posted 17 March 08 03:56 by alikl | 2 Comments   
Filed under Input Validation, Test Phase, Security, Tools

Securing IIS7 - Windows Server 2008 Security Guide

Windows Server 2008 Security Guide is out. It covers many crucial aspects but my favorite of course is IIS7 chapter: Chapter 6: Hardening Web Services This chapter provides prescriptive guidance for hardening the Web Server role. The chapter discusses Read More...

Posted 28 February 08 07:09 by alikl | 1 Comments   
Filed under Security, Deployment Phase, Deployment Inspection, IIS 7, Planning Phase

Security Code Review – Use Visual Studio Bookmarks To Capture Security Findings

How to streamline the process of capturing security flaws during security code review? How to save time and avoid switching between the tools? How to stay focused? In this post I will show my simple technique to capture security flaws using Bookmarks Read More...

Posted 24 January 08 01:38 by alikl | 3 Comments   
Filed under Test Phase, Security, Tools, Code Inspection, Practices

Chain Of Responsibility Design Pattern – Focus On Security, Performance, And Operations

The pattern is also called Intercepting Filter, Pipeline, AOP, and may be few more… I am confused by the name for this design pattern. “Life is really simple, but we insist on making it complicated.” - Confucius No matter how they call Read More...

Posted 14 January 08 03:50 by alikl | 1 Comments   
Filed under Security, Implementation, Performance, Planning Phase

Basic HttpModule Sample (Plus Bonus Case Study - How HttpModule Saved Mission Critical Project's Life)

This post to describe basic steps to write HttpModule and how it rescued mission critical application from not hitting the dead line. HttpModule is the mechanism that facilitates implementing cross cutting logic for incoming ASP.NET requests. ASP.NET Read More...

Posted 26 December 07 10:09 by alikl | 1 Comments   
Filed under Security, Reflection, Development Phase, Implementation, Performance

ASP.NET 3.5 Extensions: Basic Steps To Create Dynamic Data Web Application - Focus On Security and Performance

This post walks through the steps I've taken to create simple Dynamic Data Web Application. I just loved the development model for DTO [Data Transfer Object] and Input Validation options. Summary of steps Step 1 - Download and install ASP.NET Extensions. Read More...

Posted 18 December 07 10:08 by alikl | 1 Comments   
Filed under Security, Development Phase, Implementation, Performance, Planning Phase, AJAX

Search

This Blog

• Home
• Email