.NET Tutorials, Forums, Interview Questions And Answers
Welcome :Guest
Sign In
Win Surprise Gifts!!!

Top 5 Contributors of the Month
Gaurav Pal
Post New Web Links

Secure By Design: Your Field Guide To Designing Security Into Networking Protocols

Posted By:      Posted Date: August 21, 2010    Points: 0   Category :ASP.Net

If you were to build a new communications protocol from scratch, how would you address security? Here the authors take a look at that question and generate some valuable insights into secure protocols.

Mark Novak and Andrew Roths

MSDN Magazine September 2006

View Complete Post

More Related Resource Links

ASP.NET Security: An Introductory Guide to Building and Deploying More Secure Sites with ASP.NET and


Forms authentication is one of the most compelling and useful new features of ASP.NET. It enables developers to declaratively specify which files on their site can be accessed and by whom, and allows identification of a login page. When an unauthenticated user attempts to retrieve a page protected by forms authentication, ASP.NET automatically redirects them to the login page and asks them to identify themselves. Included here is an overview of forms authentication and what you need to know to put it to work. Also included is hard-to-find information on the security of cookie authentication and on combining forms authentication with role-based URL authorizations.

Jeff Prosise

MSDN Magazine May 2002

ASP.NET Security: An Introductory Guide to Building and Deploying More Secure Sites with ASP.NET and


ASP.NET and Microsoft Internet Information Services (IIS) work together to make building secure Web sites a breeze. But to do it right, you have to know how the two interrelate and what options they provide for securing access to a Web site's resources. This article, the first in a two-part series, explains the ABCs of Web security as seen through the eyes of ASP.NET and includes a hands-on tutorial demonstrating Windows authentication and ACL authorizations. A range of security measures and authentication methods are discussed, including basic authentication, digest authentication, and role-based security.

Jeff Prosise

MSDN Magazine April 2002

Threat Modeling: Uncover Security Design Flaws Using The STRIDE Approach


Whenever you build a new system you should consider how an in¬truder might go about attacking it and then build in appropriate defenses at design time.

Shawn Hernan, Scott Lambert, Tomasz Ostwald, Adam Shostack

MSDN Magazine November 2006

Security Briefs: Step-by-Step Guide to InfoCard


In my April 2006 column I began a discussion of InfoCard, the upcoming identity metasystem, which is being prepared for release in the Windows VistaT timeframe. If you haven't read that column, you should definitely start there because I'm going to assume you're familiar with the basics I covered.

Keith Brown

MSDN Magazine May 2006

Are You Protected?: Design and Deploy Secure Web Apps with ASP.NET 2.0 and IIS 6.0


Ensuring the security of a Web application is critical and requires careful planning throughout the design, development, deployment, and operation phases. It is not something that can be slapped onto an existing application. In this article, Mike Volodarsky outlines best practices that allow you to take advantage of the security features of ASP.NET 2.0 and IIS 6.0 to build and deploy more secure Web applications.

Mike Volodarsky

MSDN Magazine November 2005

Secure It: WS-Security and Remoting Channel Sinks Give Message-Level Security to Your SOAP Packets


As more organizations adopt XML-based Web Services, the need for message-level security has become evident. WS-Security, now supported in the Microsoft .NET Framework, addresses this need. Using the WS-Security framework, developers can implement channel sinks to intercept Remoting messages as they pass through the .NET Remoting infrastructure. The sink can read the message, change it, and pass it along. During this process, the message can be signed for added security. This article explains how to implement a Remoting channel sink that will modify the Remoting message by including a UserName token in the header, then sign the body using the token.

Neeraj Srivastava

MSDN Magazine November 2003

WS-Security: New Technologies Help You Make Your Web Services More Secure


Without good security, Web Services will never reach their potential. WS-Security and its associated technologies, the focus of this article, represent the future of security for Web Services. Provided here is an overview of these emerging security standards that explains what they do, how they work, and how they get along together. Topics discussed include integrity and confidentiality and how these are provided by public key cryptography, WS-Security, and more. Some of the key components of WS-Security, such as the wsu namespace, are also covered.

David Chappell

MSDN Magazine April 2003

Security in IIS 6.0: Innovations in Internet Information Services Let You Tightly Guard Secure Data


Security improvements have been a top priority in the evolution of IIS. IIS 6.0, which will be part of Windows .NET Server, has improved security features and a new approach to server configuration. New security-related tools for IIS, including IIS LockDown, make securing your server against attack easier than ever. The author explains how and why you can shut down services with IIS LockDown. He discusses limiting port access with TCP/IP filtering, controlling how files are served with extension mapping, what's new for Secure Sockets Layer, the use of URLScan, and more.

Wayne Berry

MSDN Magazine September 2002

Web Security: Putting a Secure Front End on Your COM+ Distributed Applications


The Internet requires that developers provide a different security model for clients than is used on a closed network. Because it would be too resource-intensive for both the client and server to prove their identity to each other, you need to look at other ways to ensure secure communications. This article covers the options, from digital certificates to public and private key encryption to Secure Sockets Layer and Web certificates. The discussion covers the installation of certificates in Microsoft Internet Information Services along with other options specific to IIS. This article was adapted from Keith Brown's Programming Windows Security (Addison-Wesley), due out in July 2000.

Keith Brown

MSDN Magazine June 2000

Administrator and Developer Guide to Code Access Security in SharePoint Server 2007

Explore configuration options, get best practices for managing CAS in SharePoint environments, and walk through a complex CAS scenario.

Secure channel cannot be opened because security negotiation with the remote endpoint has failed

Please help me to pinpoint what's wrong with the configurations. CoreClient client = new CoreClient(); client.ClientCredentials.UserName.UserName = "test"; client.ClientCredentials.UserName.Password = "test"; string msg = client.SayHello(); //==== ERROR Happens here Error message: Secure channel cannot be opened because security negotiation with the remote endpoint has failed. This may be due to absent or incorrectly specified EndpointIdentity in the EndpointAddress used to create the channel. Please verify the EndpointIdentity specified or implied by the EndpointAddress correctly identifies the remote endpoint. Configurations: Host: <behaviors> <serviceBehaviors> <behavior name="DefaultBehavior"> <serviceMetadata httpGetEnabled="true"/> <serviceDebug includeExceptionDetailInFaults="false"/> <serviceCredentials> <serviceCertificate findValue="MyServerCert" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My"/> <userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="Promotion.Services.UsernameValidator, LibraryIIS" /> </serviceCredentials> </behavior>

Security Update for Win 2003 Server (KB980436) causes access error to secure url via WCF



today in the morning i installed 5-6 security updates including (KB980436) on our production server. During the day we got errors when our application calls a secured web service :

An error occurred while making the HTTP request to https://[MyService]. This could be due to the fact that the server certificate is not configured properly with HTTP.SYS in the HTTPS case. This could also be caused by a mismatch of the security binding between the client and the server.

I had nothing to do because we haven't made any change at our application. Then i remembered the security updates and walked through the update informations. I saw that KB is about :

MS10-049: Vulnerabilities in SChannel could allow remote code execution

I removed this update because its about secure channel, then everything worked fine.

So what should we do ? Who should be informed ?

SSAS 2008 - Security Architecture Design?


Hi, I would like to know BEST way to design SSAS 2008 security architecture for my organization.

I have different data sources in SQL Server 2008 and those ETL store data into datawarehouse (dimension, fact) and then I create cube on that dw. What I want to do is BEST way to desgin SECURITY architecture to browse cube as per ORGANIZATION CHART.

Like we have different companies >>> divided into Division >>> SubDivisions >>> Business Stream >>> Region (i.e. west, east) >>> .....

For example if person has WEST REGION access than he can only see WEST region not the other region but he need access to correct COMPANY >> DIVISON >> SUBDIVISION >> BUSINESS STREAM >> REGION - WEST only.

Please someone can provide BEST possible solution/ideas to design this sort of SECURITY architecture. Thank You.

Designing lists: Quick key combination for adding a new list column field?


I'm simply looking for a way to quickly design lists, and I find it rather slow to use the mouse to go to the Add New Column button in the ribbon every time when I want to add a new list field.

The only column that can't be changed type of later seems to be the Calculated column. But for all others, you can still change them afterwards.

User guide on Sharepoint 2007 security and Administration


Hi All - Can any one provide me user guide on sharepoint 2007 security groups,Audience targetting,Backup and restore options. If you already developed one for your firm. I need one very badly. I started doing one but I am new to administration part please give me doc you already have very helpful to me.




saritha k

how to implement field-level security

I need to set up a list in which "A" users can only view and edit a subset of the fields in a custom list, while "B" users can veiw and edit all fields.  It would also be nice if, when an "A" user creates a new list item, one of the fields that is only accessible to "B" users could be set to a pre-determined value.

I'm open to different approaches here (different views of the same list, different lists with some automated way to copy items from the one list to the other, a single view of a single list with some mechanism to enforce the restrictions outlined above, or perhaps some other approach I haven't thought of).  My biggest concern is that the solution be as straightforward and simple to implement as possible.  I'm an experienced VB/C#/SQL developer, but my exposure to SharePoint has been limited to setting up and customizing very simple sites via a web browser.  I have absolutely no experience using SharePoint Designer, or any other SharePoint development tool, and am not sure I will have the time to learn it to complete this project.

Thanks in advance for your suggestions.
ASP.NetWindows Application  .NET Framework  C#  VB.Net  ADO.Net  
Sql Server  SharePoint  Silverlight  Others  All   

Hall of Fame    Twitter   Terms of Service    Privacy Policy    Contact Us    Archives   Tell A Friend