Alik Levin's

Browse by Tags

Security Code Review – String Search Patterns For Authorization Vulnerabilities: These are the questions and the search criteria I use to identify authorization vulnerabilities in the code beyond web.config <authorization> node. How does the code protect access to page classes? Attributes Search for PrincipalPermission attributes. Read More...
Posted 24 July 08 10:53 by alikl | 1 Comments
Filed under Test Phase, Security, Authorization
Security Code Review – String Search Patterns For Authentication Vulnerabilities: This post contains string search patterns that can help identifying authentication vulnerabilities during security code inspection for your ASP.NET application . Most common vulnerability is about insecurely manipulating credentials in the code. The question Read More...
Posted 21 July 08 03:39 by alikl | 0 Comments
Filed under Test Phase, Security, Authentication
Security Code Review – String Search Patterns For Finding Input Validation Vulnerabilities: Well defined set of search patterns helps significantly reduce time (cost) when performing security code inspections. This post focuses on input validation vulnerabilities commonly found in ASP.NET web applications. SQL Injection and Cross Site Scripting Read More...
Posted 11 July 08 02:24 by alikl | 2 Comments
Filed under Input Validation, Test Phase, Security, Tools
patterns & practices Improving Web Services Security: Scenarios and Implementation Guidance for WCF - BETA Is Out: patterns & practices team has just released a beta version of WCF Security Guide on Codeplex. Download the guide at http://www.codeplex.com/WCFSecurityGuide . Original announcement by J.D. Meier, the man behind the effort, is here - New Release: patterns Read More...
Posted 05 June 08 04:57 by alikl | 0 Comments
Filed under WCF, Security, Practices
WCF Security - Input/Data Validation Using Schemas: WCF offers very flexible approach of Input and Data Validation based on XML Schemas. The approach is flexible since the validation rules are expressed in form of XML schema and can be changed at any time without recompiling the solution. I followed the Read More...
Posted 25 May 08 03:52 by alikl | 0 Comments
Filed under WCF, Input Validation, Security, Development Phase, Implementation
WCF Security - Input/Data Validation Sample Visual Studio Project: Input and Data Validation is one of the core security principles . WCF is no exception . To get most out of WCF in secure way one must implement proper Input and Data Validation. I was following instructions on How To – Perform Input Validation Read More...
Posted 25 May 08 12:17 by alikl | 1 Comments
Filed under WCF, Input Validation, Security, Development Phase, Implementation
patterns & practices WCF Security Guidance Project - live on Codeplex: patterns & practices has recently released WCF Security Guidance Project . JD , the program manager behind the effort, has been blogging about it too.It is evolving project but the initial content is fantastic already. It has Application Scenarios Read More...
Posted 02 April 08 08:53 by alikl | 0 Comments
Filed under WCF, Security, Development Phase, Implementation, Practices
Quickly Find And Fix Cross Site Scripting (XSS) Vulnerabilities In Your ASP.NET Application.: Want to quickly check your ASP.NET Web application for Cross Site Scripting (XSS) vulnerability ? It is pretty easy with the knowledge and tools you already have. This post describes how to quickly find and fix most of XSS vulnerabilities in your code. Read More...
Posted 17 March 08 03:56 by alikl | 1 Comments
Filed under Input Validation, Test Phase, Security, Tools
Securing IIS7 - Windows Server 2008 Security Guide: Windows Server 2008 Security Guide is out. It covers many crucial aspects but my favorite of course is IIS7 chapter: Chapter 6: Hardening Web Services This chapter provides prescriptive guidance for hardening the Web Server role. The chapter discusses Read More...
Posted 28 February 08 07:09 by alikl | 0 Comments
Filed under Security, Deployment Phase, Deployment Inspection, IIS 7, Planning Phase
Security Code Review – Use Visual Studio Bookmarks To Capture Security Findings: How to streamline the process of capturing security flaws during security code review? How to save time and avoid switching between the tools? How to stay focused? In this post I will show my simple technique to capture security flaws using Bookmarks Read More...
Posted 24 January 08 01:38 by alikl | 3 Comments
Filed under Test Phase, Security, Tools, Code Inspection, Practices
Chain Of Responsibility Design Pattern – Focus On Security, Performance, And Operations: The pattern is also called Intercepting Filter, Pipeline, AOP, and may be few more… I am confused by the name for this design pattern. “Life is really simple, but we insist on making it complicated.” - Confucius No matter how they call Read More...
Posted 14 January 08 03:50 by alikl | 1 Comments
Filed under Security, Implementation, Performance, Planning Phase
Basic HttpModule Sample (Plus Bonus Case Study - How HttpModule Saved Mission Critical Project's Life): This post to describe basic steps to write HttpModule and how it rescued mission critical application from not hitting the dead line. HttpModule is the mechanism that facilitates implementing cross cutting logic for incoming ASP.NET requests. ASP.NET Read More...
Posted 26 December 07 10:09 by alikl | 1 Comments
Filed under Security, Reflection, Development Phase, Implementation, Performance
ASP.NET 3.5 Extensions: Basic Steps To Create Dynamic Data Web Application - Focus On Security and Performance: This post walks through the steps I've taken to create simple Dynamic Data Web Application. I just loved the development model for DTO [Data Transfer Object] and Input Validation options. Summary of steps Step 1 - Download and install ASP.NET Extensions. Read More...
Posted 18 December 07 10:08 by alikl | 1 Comments
Filed under Security, Development Phase, Implementation, Performance, Planning Phase, AJAX
Avoid Manipulating Passwords In Memory - It Is Easy To Reveal: Revealing clear text passwords in memory seems to be a trivial task. This post describes how to reveal clear text passwords and what countermeasures to apply. Summary of steps: Install WinDbg Attach to process or open dump file Load SOS .Net extensions Read More...
Posted 08 December 07 05:55 by alikl | 3 Comments
Filed under Test Phase, Security, Sensitive Data, Authentication, Planning Phase
ASP.NET 2.0 Internet Security Reference Implementation - Have It Handy: JD Meier writes in his blog : The ASP.NET 2.0 Internet Security Reference Implementation is a sample application complete with code and guidance. Our purpose was to show patterns & practices security guidance in the context of an application scenario. Read More...
Posted 21 November 07 10:04 by alikl | 4 Comments
Filed under Security, Development Phase, Implementation, Deployment Phase, Practices, Inception Phase

More Posts Next page »

Search

Go

This Blog

Home
Email

Archives

. My Personal Blog .

Practice This

.Net Performance How To's

.Net Security How To's

Design Patterns

Impactful

Lifecycle Phases

Popular

Tools

Syndication