Building a secure asp.net application

Building a secure asp.net application


The total list of road maps


Overview


Profile


asp.net application security model


Authentication and Authorization


Secure Communication


Intranet


Extranet Security


Internet


asp.net security


Enterprise Service Security


Web Services Security


Remote processing Security


Data Access Security

Troubleshoot
security issues

How does
do (how to) article collection


Appendix:


Working principle


asp.net identification matrix


Basic Configuration


Configuration Storage and tools


Keys and certificates


. NET WEB Application Security

Glossary of
Terms


Reference Center





authentication, authorization, and secure communications


j.d Meier, Alex Mackman, Michael dunner and Srinath Vasireddy


Microsoft Corporation


October 2002


Overview


This section provides an overview of the general content and scope of each chapter of this guide.


1th Chapter-Introduction


This chapter highlights the objectives of this guide, introduces key terminology, and presents the central principles followed by the following chapter guidelines.


2nd Chapter-.net WEB Application security model


This chapter introduces the common characteristics of. NET Web applications from a security perspective, introduces the. NET Web Application security model, and describes the core implementation technologies that will be used when building secure. NET Web applications.


at the same time, this chapter describes the various gatekeeper programs that can be used to develop defense-in-depth security policies, and explains the concept of using principal objects and identity objects for host-based authorization.


This chapter will help you answer the following questions:

What are the deployment patterns commonly used by
. NET Web applications?

What are the security features provided by the various technologies used by
to build. NET Web applications?


What kind of gatekeeper should I know? How do you use them to provide defense-in-depth security policy?


what is a principal object and an identity object? Why are they so important?

What is the relationship between
. NET security and Windows security?


3rd Chapter-Authentication and authorization


designing a consistent authentication and authorization strategy across application tiers is a critical task. This chapter provides guidance to help you develop appropriate policies for specific application scenarios, and also helps you choose the most appropriate authentication and authorization technologies and apply them to your application in the right way.


read this chapter to learn how to perform the following tasks:


Select the appropriate authentication mechanism to identify the user.


develop an effective authorization policy.


Select the appropriate role-based security type.


Compare and contrast the. NET role and the Enterprise Services (COM +) role.


uses database roles.