Hacking the Code ASP.NET Web Application Security [Electronic resources] نسخه متنی

This unique book walks you through the many threats to your web application code, from managing and authorizing users and encrypting private data to filtering user input and securing XML. For every defined threat, it provides a menu of solutions and coding considerations. And, it offers coding examples and a set of security policies for each of the corresponding threats.

Know the threats to your applications:

Develop secure password policies and securely manage user passwords in your web application.
Establish a secure procedure for resetting lost or forgotten passwords and discover how to properly use secret questions in that process.
Securely authenticate and authorize users, taking advantage of the advanced capabilities in ASP.NET.
Limit exposure to credential harvesting and brute force password attacks.
Securely manage user sessions and learn how to create strong user authentication tokens.
Work with the built-in state providers and securely implement view state in your forms.
Make sense of the extensive encryption features in ASP.NET and employ symmetric and asymmetric encryption for sensitive data.
Properly encrypt and store secrets to the registry, a file, or the protected store.
Filter user input to prevent from SQL injection, directory traversal, cross-site scripting and other application-level attacks.
Apply techniques such as pattern matching and data reflecting to control exposure to malicious input attacks.
Configure honey drops to detect attacks on your web application.
Configure IIS and ASP.NET to constrain buffer overflow, denial of service, and other attacks.
Write secure database access code.
Secure databases and database drivers.
Construct secure HTML markup to limit exposure to cross-site scripting and cross-site request forgery attacks.
Use structured error handling to prevent failure conditions that open holes or reveal sensitive information.
Integrate XML encryption and apply XML digital signatures.

About the Author and Technical Editor

Mark Burnett (Microsoft MVP) is an independent security consultant, freelance writer, and a specialist in securing Windows-based IIS Web servers. Mark is co-author of Maximum Windows Security and is a contributor to Stealing the Network: How to Own the Box (Syngress Publishing) and Dr. Tom Shinder’s ISA Server and Beyond: Real World Security Solutions for Microsoft Enterprise Networks (Syngress Publishing). He is a contributor and technical editor for Syngress Publishing’s Special Ops: Host and Network Security for Microsoft, UNIX, and Oracle. Mark speaks at various security conferences and has published articles in Windows & .NET, Information Security, Windows Web Solutions, Security Administrator, and is a regular contributor at SecurityFocus.com. Mark also publishes articles on his own Web site, IISSecurity.info.

James C. Foster is the Deputy Director, Global Security Development for computer Sciences Corporation where he is leading the task of developing and delivering managed, education, informational, consulting, and outsourcing security services. Prior to joining CSC, Foster was the Director of Research and Development for Foundstone Inc. and was responsible for all aspects of product and corporate R&D including corporate strategy and international market expansion. Preceding Foundstone, Foster was a Senior Adviro and Research Scientist with Guardent Inc. (acquired by Verisign in 2004 for $135 Million) and an adjunct author at Information Security Magazine (acquired for an undisclosed amount by TechTarget in 2003). He is commonly asked to comment on pertinent security issues and has been cited in USAToday, Information Security Magazine, Baseline, Computer World, Secure Computing, and theMIT Technologist. James has co-authored or contributed to Snort 2.0 Intrusion Detection, and Special Ops Host and Network Security for Microsoft, UNIX, and Oracle (both published by Syngress), as well as Hacking Exposed, Fourth Edition, Advanced Intrusion Detection, Anti-Hacker Toolkit Second Edition, and Anti-Spam Toolkit. James has attended Yale, Harvard, and the University of Maryland and has an AS, BS, MBA and is currently a Fellow at the University of Pennsylvania’s Wharton School of Business.