David Boschmans Weblog : Security

Interesting links from my unread RSS Feed Items

David Boschmans — Wed, 21 Feb 2007 00:34:58 GMT

Due to a busy travel schedule and working on the agenda of Dev & IT-Pro Days 2007, I haven't been able to read all the posts from the blogs I'm subscribed to. But this week I've a couple of days of holidays, which allows me to catch up on "unread" RSS feeds. Here are the most interesting links I came across:

Microsoft Best Practices Analyzer for Windows SharePoint Services 3.0 and the 2007 Microsoft Office System. (Via Alexander Windel)
The Microsoft Best Practices Analyzer for Windows SharePoint Services 3.0 and the 2007 Microsoft Office System Best Practices Analyzer programmatically collects settings and values from data repositories such as MS SQL, registry, metabase and performance monitor. Once collected, a set of comprehensive ‘best practice’ rules are applied to the topology.
Administrators running this tool will get a detailed report listing the recommendations that can be made to the environment to achieve greater performance, scalability and uptime.
Install instructions can be found here.
patterns & practices Performance Testing Guidance
The purpose of this project is to build some insightful and practical guidance around doing performance testing and using Visual Studio 2005. It's a collaborative effort between industry experts, Microsoft ACE, patterns & practices, Premier, and VSTS team members.
Usage Scenarios:
- Improve efficiency and effectiveness of your performance testing
- Learn expert techniques performance testing
- Apply expert techniques for performance testing using Visual Studio.NET 2005
OneNote 2007 PowerToys (Via Chris Pratley)
A set of nex PowerToys for OneNote 2007 is about to be released by Daniel Escapa.
The ones out so far are:
- Word Count
- Send to OneNote (from the file explorer/shell)
- Export Outlook Notes to OneNote

The 3^rd installment of the “Live From Redmond”: AJAX Security Webcast Series is now available for on-demand viewing. On-Demand HERE
This Webcast will cover advanced cross-site scripting (XSS) attack methods, such as Web malware, XSS in e-mail, Datamining with AJAX and virus’s that run inside of Web browsers. We will cover the impact of these attacks and how they can be used to steal cookies. In addition, we will review how mistakes in AJAX style programming could introduce security vulnerabilities into your code.
Keyboard Shortcut Reference Posters:
SQL Server 2005 Service Pack 2: Now fully compatible with Windows Vista and the 2007 Microsoft Office system
Virtual PC 2007 is now available: Whether Microsoft virtualization technology is an important component of your existing infrastructure or you're just a Virtual PC enthusiast, you can now download Virtual PC 2007 absolutely free.
Hooked on LINQ: This website aims to be the premier community resource for LINQ (Language Integrated Query) for Microsoft®'s .NET. (Via Frank Arrigo and Brain Madsen)
Windows Sidebar Styler: This is an application which takes advantage of various technologies introduced in Windows Vista in order to provide extensions to the existing functionality of Windows Sidebar. Haven't tried it but worth having a look at. (Via Eric Nelson)
DinnerNow v1.2 is now available (via James Conard)
Support for Reflector 5.0 in TestDriven.NET 2.3 (via Jamie Cansdale & Lutz Roeder)

Technorati tags: Windows SharePoint Services 3.0, OneNote 2007, AJAX Security, SQL Server SP2, VPC 2007, LINQ, DinnerNow, Reflector 5.0

VISUG discusses the Security Development Lifecycle

David Boschmans — Mon, 23 Oct 2006 09:29:01 GMT

It looks like 2 of the Belgian INETA user groups decided to make it a User Group Wednesday on October 25. Both FxUserGroup and VISUG are organizing a free event.

The VISUG meeting, with Wim Verhaeghen as guest speaker, will be covering the Security Development Lifecycle.

More details on the meeting:

When: Wednesday October 25, 19:00 – 21:30
Where: Ordina, Boomsesteenweg 28, 2627 Schelle
Food: 18:30 - 19:00
How to register: Confirm your presence by leaving a comment over here

Description:
The software industry has been struggling with how to create and release software that is more security-enhanced and reliable. The Security Development Lifecycle (SDL) provides a methodology that works; it is a critical way to help reduce the number of security defects in code at every stage of the development process, from design to release. When compared to software that has not been subject to the SDL, software that has undergone the SDL has experienced a significantly reduced rate of external discovery of security vulnerabilities. During this presentation Wim Verhaeghen will introduce you in the process of developing software that needs to withstand malicious attack.

Last week I noticed the availability of this previously internal-only available document "Privacy Guidelines for Developing Software Products and Services". This covers one of the aspects of the SDL and is very useful for customers and partners looking for privacy guidelines for developers.

Failing to protect customer privacy can lead to an erosion of trust. Over the last several years, Microsoft has established extensive internal guidelines for developers that help them protect customer privacy, give them a view into customer expectations and global privacy laws, and document the hard lessons we’ve learned. These guidelines have been engrained in our development process and are now incorporated into the Security Development Lifecycle (SDL). The impact has been felt across Microsoft’s products and services.
In response to requests from customers, partners, ISVs, educators, advocates, and regulators, we created a public set of privacy guidelines for developing software products and services. These guidelines are based on our internal guidelines and our experience incorporating privacy into the development process. By documenting our principles, we hope to help anyone building products and services to meet customer expectations and deliver a more trustworthy experience.
As the threat landscape escalates, customers are feeling less able to control access to their personal information, so consumer trust is waning. As an industry, we need to set a high bar for respecting customer privacy, to help build greater trust in the Internet and e-commerce. We want to foster an open dialogue with others in the industry so we can build a common set of privacy best practices to help meet our privacy obligations and increase customer trust. We are pleased to offer our guidelines as a starting point to accelerate this effort.

You can get the document from the Microsoft download center.

Technorati tags: VISUG, Community, Security Development Lifecycle, Privacy Guidelines for Developing Software Products and Services

Windows Vista Sample Credential Providers Overview

David Boschmans — Fri, 30 Jun 2006 10:37:00 GMT

Microsoft has made available for download a document discussing some custom Windows Vista credential provider samples. Specifically, the following topics are covered:

Understanding the base SampleCredentialProvider codebase.
Common tasks for extending the base SampleCredentialProvider codebase.
SampleCredUICredentialProvider, which supports CredUI.
SampleAllControlsCredentialProvider, which exposes each possible UI control.
SampleHardwareEventCredentialProvider, which supports asynchronous events.
SampleWrapExistingCredentialProvider, which wraps the default username/password credential provider in Windows Vista.

Microsoft previously released a version of SampleCredentialProvider. This new release of the samples has the following changes:

4 new samples showing uses of additional features of the credential provider model
Updated the base samplecredentialprovider in the following ways
- Fixed the issue where the release configuration wouldn’t build
- Built & tested in on x64fre
- Fixed a bug in the implementation of GetBitmapValue that caused the tiles not to show up on some machines. Note: Everyone should make sure they pick up this fix.
- Added an implementation of SetSerialization

Download the Windows Vista Sample Credential Providers Overview for build 5384 (beta 2) at http://www.microsoft.com/downloads/details.aspx?FamilyID=1287ec56-77b4-48c4-8b58-35b7295d6c2c&DisplayLang=en

Tags: Microsoft, Windows Vista, WinFX, .NET development

MSDN Security Evenings

David Boschmans — Sun, 16 Apr 2006 12:56:00 GMT

From next week on the Belgian Developer audience team in partnership with MSDN Academic Alliance organizes 7 MSDN Security Evenings. These localized sessions (in Ducth & French) on security will be delivered by two of our Begian Community members Bart De Smet and Grégory Renard.

During these security evenings software developers and software architects will learn how to build safe applications. Typically developers don't want to spend an inordinate amount of time learning about securing their applications. They would rather write the code and the algorithms that solve the problem and ship the product, without having to worry about security. Currently, however, we can't build fire and forget applications. We need to understand the security implications of the decisions we make. With that in mind, the tools we use to build and ship applications can make it much easier to ship secure applications.

Besides covering some of the features of Visual Studio 2005 which can help you build secure and robust applications, the session will also cover some of the most common security problems and challenges software devs and architects face. Most of the tools and enhancements in Visual Studio 2005 require very little extra work and can have a tremendous impact on the overall security of your applications. Security problems like Cross-site scripting (XSS), one-click attacks, SQL Injection and canonicalization issues will be shown. We will also shed a light on the Microsoft security development lifecycle.

Security Development Lifecycle = Process + Education + Accountability

The SDL is a process by which Microsoft develops software, that defines security requirements and milestones. This is a mandatory process for products that are exposed to meaningful security risks. It has shown itself to be highly effective at reducing vulnerabilities in commercial software. The SDL puts Microsoft on path toward more secure software.
More in-depth info on the SDL can be found in the coming Security Development Lifecycle book by Michael Howard and Steve Lipner.

Below is the MSDN Secuirty Evenings calendar:

Location		Language	Date	Time	Registration
Mons	Faculté Polytechnique de Mons	French	April 19, 2006	18:00
Oostende	Katholieke Hogeschool Brugge-Oostende	Dutch	April 26, 2006	18:00
Seraing	Haute Ecole Rennequin Sualem	French	April 27, 2006	19:30
Anderlecht	Erasmus Hogeschool Brussel	Dutch	April 28, 2006	18:00
Antwerpen	Karel de Grote-Hogeschool Antwerpen	Dutch	May 2, 2006	19:00
Kortrijk	Hogeschool West-Vlaanderen - Departement PIH	Dutch	May 10, 2006	18:00
Leuven	Katholieke Hogeschool Leuven - Rega	Dutch	May 11, 2006	09:00

More info on these MSDN Secuirty Evenings can be found here.