<?xml version="1.0" encoding="iso-8859-1"?>
<rss version="2.0">
<channel>
<title> .NET news &gt;&gt; Security</title>
<link>http://www.dotnetcat.com/news/Security/</link>
<description>.NET developer news by tags: C#, ASP.NET, VB.NET, database, security, performance and more</description>
<language>en-us</language>
<item>
<title>Using AppDomains to Build Reliable Systems</title>
<link>http://www.dotnetcat.com/news/Security/id/9181/</link>
<pubDate>Sun, 13 Jul 2008 13:24:00 -0500</pubDate>
<description> <![CDATA[ The first step to building reliable systems is to accept that it is impossible.
Instead, we will attempt to build a more reliable system from a collection of smaller unreliable components. The idea is to manage failure rather than pursue an impossible perfection. Find out how. ]]> </description>
</item>
<item>
<title>.NET Internals and Native Compiling</title>
<link>http://www.dotnetcat.com/news/Security/id/8986/</link>
<pubDate>Fri, 30 May 2008 15:11:00 -0500</pubDate>
<description> <![CDATA[ An article about .NET internals and native compiling. ]]> </description>
</item>
<item>
<title>.NET Role-Based Security in a Production Environment</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/8952/</link>
<pubDate>Mon, 19 May 2008 05:04:00 -0500</pubDate>
<description> <![CDATA[ Edit web.config to Update the Data Provider for Shared Hosting with Role-Based Security: SQL Server, ODBC, Active Directory, ADAM, SQLite, MySQL, Access, XML ]]> </description>
</item>
<item>
<title>RSA Cryptographic Key Interoperability</title>
<link>http://www.dotnetcat.com/news/Security/id/8792/</link>
<pubDate>Wed, 23 Apr 2008 01:57:00 -0500</pubDate>
<description> <![CDATA[ Import and Export RSA Keys in PKCS#8 and X.509 Format using Crypto++, C#, and Java ]]> </description>
</item>
<item>
<title>Building Personalized Applications on the Windows Live ID Platform</title>
<link>http://www.dotnetcat.com/news/Web-Services/id/8643/</link>
<pubDate>Thu, 13 Mar 2008 19:00:00 -0500</pubDate>
<description> <![CDATA[ Do you have a cool personalized application that you want to offer to over 400 million users? Do you want to light it up with Live controls or create a mashup with Live resources?Windows Live ID now offers a simple way for third parties to get Live ID authentication in your Web or rich client applications, letting you reach millions of Live ID users, integrate with Live Controls, and access Live services.
 ]]> </description>
</item>
<item>
<title>Never Write an Insecure ASP.NET Application Ever Again</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/8656/</link>
<pubDate>Mon, 10 Mar 2008 20:14:26 -0500</pubDate>
<description> <![CDATA[ Learn to take advantage of the inner workings of ASP.NET's security model to help eliminate security vulnerabilities from your web applications.
 ]]> </description>
</item>
<item>
<title>Never Write an Insecure ASP.NET Application Ever Again</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/8436/</link>
<pubDate>Thu, 27 Dec 2007 18:00:00 -0600</pubDate>
<description> <![CDATA[ One of the most important security principles for software development is least privilege. Simply put, least privilege means that an application, process, or user should have the least access to resources required to accomplish a task and no more. By following this principle, even if your application is attacked or a user goes on the payroll of your nastiest competitor, you'll have limited the potential damage. Bottom line: implementing partial trust in ASP.NET is the single biggest thing you can do to make your applications secure. ]]> </description>
</item>
<item>
<title>Office Space: Security Programming in SharePoint 2007</title>
<link>http://www.dotnetcat.com/news/SharePoint/id/8373/</link>
<pubDate>Mon, 17 Dec 2007 18:00:00 -0600</pubDate>
<description> <![CDATA[ This month Ted Pattison presents an overview of programming security and permissions for Windows SharePoint Services 3.0. ]]> </description>
</item>
<item>
<title>Authenticate Users Across Organizations Using ADFS</title>
<link>http://www.dotnetcat.com/news/Security/id/8305/</link>
<pubDate>Tue, 23 Oct 2007 19:00:00 -0500</pubDate>
<description> <![CDATA[ Active Directory Federation Services (ADFS) was introduced in Windows Server 2003 for organizations that need to participate in standards-based identity federation. With ADFS, you can more easily validate identity data from other organizations, leading to greater interoperability with your partners. In this article, I'll take you on a guided tour of ADFS in action, using the experiences of a fictitious online service provider (A. Datum Corporation) that uses ADFS to interact with a real online service provider (UnderMyControl.com) and a fictitious customer (Tailspin Toys). ]]> </description>
</item>
<item>
<title>Using RSA Public Key Encryption in a Shared Webhosting Environment</title>
<link>http://www.dotnetcat.com/news/Security/id/8197/</link>
<pubDate>Sat, 20 Oct 2007 10:26:00 -0500</pubDate>
<description> <![CDATA[ This article provides a way to use RSA public key encryption in scripts running on a webserver hosted by a shared hosting company. It also demonstrates how to use RSA in .Net to solve the 'real world' problem of signing license codes so that they cannot be forged.
 ]]> </description>
</item>
<item>
<title>SQL Trusted Connections with ASP.NET</title>
<link>http://www.dotnetcat.com/news/Database/id/8140/</link>
<pubDate>Tue, 09 Oct 2007 21:03:00 -0500</pubDate>
<description> <![CDATA[ Hard coding passwords into your application or your web site is a bad thing. Barry looks at how we can use trusted connections to provide the authentication we need, without the need for these potential security hazards. ]]> </description>
</item>
<item>
<title>Apply Visual Studio Code Analysis to Beef Up Security</title>
<link>http://www.dotnetcat.com/news/Security/id/8013/</link>
<pubDate>Thu, 20 Sep 2007 23:55:01 -0500</pubDate>
<description> <![CDATA[ Visual Studio's code analysis feature offers hidden extensibility opportunities for writing custom security code review rules. ]]> </description>
</item>
<item>
<title>Public/Private Key Encrypted Messenger</title>
<link>http://www.dotnetcat.com/news/Examples/id/7990/</link>
<pubDate>Mon, 17 Sep 2007 06:47:00 -0500</pubDate>
<description> <![CDATA[ An article about creating a public/private key encrypted internet messenger ]]> </description>
</item>
<item>
<title>Parallel LINQ: Running Queries On Multi-Core Processors</title>
<link>http://www.dotnetcat.com/news/Security/id/7957/</link>
<pubDate>Tue, 21 Aug 2007 19:00:00 -0500</pubDate>
<description> <![CDATA[ PLINQ is a query execution engine that accepts any LINQ-to-Objects or LINQ-to-XML query and automatically utilizes multiple processors or cores for execution when they are available. The change in programming model is tiny, meaning you don't need to be a concurrency guru to use it. In fact, threads and locks won't even come up unless you really want to dive under the hood to understand how it all works. PLINQ is a key component of Parallel FX, the next generation of concurrency support in the Microsoft .NET Framework.

In this article, we review the goals of the PLINQ technology, where it fits into the broader .NET Framework and other concurrency offerings, and what it looks like from the perspective of LINQ developers. We conclude with some example scenarios where PLINQ has already shown tremendous value... ]]> </description>
</item>
<item>
<title>Exploring Claims-Based Identity</title>
<link>http://www.dotnetcat.com/news/Security/id/7836/</link>
<pubDate>Mon, 16 Jul 2007 19:00:00 -0500</pubDate>
<description> <![CDATA[ Most enterprise applications need some basic user security features. At a minimum, they need to authenticate their users, and many also need to authorize access to certain features so that only privileged users can get to them. Some apps must go further and audit what the user does. On Windows&reg;, these features are built into the operating system and are usually quite easy to integrate into an application. By taking advantage of Windows integrated authentication, you don't have to invent your own authentication protocol or manage a user database. By using access control lists (ACLs), impersonation, and features such as groups, you can implement authorization with very little code. Indeed, this advice applies no matter which OS you are using. It's almost always a better idea to integrate closely with the security features in your OS rather than reinventing those features yourself.

But what happens when you want to extend reach to users who don't happen to have Windows accounts? What about users who aren't running Windows at all? More and more applications need this type of reach, which seems to fly in the face of traditional advice. This column will introduce you to the new identity model in the Microsoft .NET Framework 3.0, which is designed to help address these and other problems. ]]> </description>
</item>
<item>
<title>Tales from the CryptoRandom</title>
<link>http://www.dotnetcat.com/news/Security/id/7837/</link>
<pubDate>Mon, 16 Jul 2007 19:00:00 -0500</pubDate>
<description> <![CDATA[ I'm using the System.Random class to generate some random numbers in my application. A coworker reviewed my code and suggested that I use RNGCryptoServiceProvider instead. I'd like to follow her suggestion, but I'd also like not to have to modify all of my code that uses Random, and RNGCryptoServiceProvider looks nothing like Random in terms of the methods it exposes. Do you have any suggestions for making this easier?.. ]]> </description>
</item>
<item>
<title>Declarative WCF Security</title>
<link>http://www.dotnetcat.com/news/Security/id/7728/</link>
<pubDate>Mon, 18 Jun 2007 19:00:00 -0500</pubDate>
<description> <![CDATA[ Juval Lowy designs easily configured security settings for applications built on Windows Communication Foundation.
 ]]> </description>
</item>
<item>
<title>eDirectory Authentication using LdapConnection and custom certificate validation</title>
<link>http://www.dotnetcat.com/news/Security/id/7545/</link>
<pubDate>Thu, 07 Jun 2007 14:43:00 -0500</pubDate>
<description> <![CDATA[ This article explains how to authenticate a user over LDAPS using the System.DirectoryServices.Protocols.LdapConnection class, performing custom certificate validation. 
 ]]> </description>
</item>
<item>
<title>How-to safely keep a password field during postbacks and why it shouldn't be done</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/7442/</link>
<pubDate>Thu, 24 May 2007 18:40:00 -0500</pubDate>
<description> <![CDATA[ Think of this article as a beginners guide to think about design and security when solving problems. ]]> </description>
</item>
<item>
<title>Eliminate SQL Injection Attacks Painlessly with LINQ</title>
<link>http://www.dotnetcat.com/news/Database/id/7448/</link>
<pubDate>Thu, 24 May 2007 16:31:02 -0500</pubDate>
<description> <![CDATA[ As developers assume more of the security burden, the first web application vulnerability that many developers learn about is a particularly dangerous form of command injection known as SQL injection. Command injection in its archetypal form is any vulnerability that allows an attacker to run an unintended command on your server by providing unanticipated input that alters the way you intended the web application to run. Because it's so well-known, SQL injection attacks are common, dangerous, and pervasive. Fortunately, you can prevent SQL injection easily once you understand the problem. Even better, a new Microsoft data access technology offers .NET developers the opportunity to eliminate SQL injection vulnerabilities altogether—when used properly. That technology is called Language Integrated Query (LINQ), and it will ship in the upcoming release of Visual Studio &quot;Orcas&quot; and .NET Framework 3.5. This article explores LINQ's potential for hardening your web application's data access code so that it's impossible to attack through SQL Injection. ]]> </description>
</item>
<item>
<title>Top 10 Application Security Vulnerabilities in Web.config Files - Part Two</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/7429/</link>
<pubDate>Tue, 22 May 2007 09:45:00 -0500</pubDate>
<description> <![CDATA[ In this second part of a two-part series, you will learn about application security issues related to authentication and authorization, as well as five vulnerabilities commonly found in ASP.NET web-based applications. ]]> </description>
</item>
<item>
<title>Applying Cryptography Using The CNG API In Windows Vista</title>
<link>http://www.dotnetcat.com/news/Security/id/7584/</link>
<pubDate>Mon, 21 May 2007 19:00:00 -0500</pubDate>
<description> <![CDATA[ Windows Vista introduces a new cryptography API to replace the old CryptoAPI, which has its roots in the early versions of Windows NT and Windows 95. Cryptography Next Generation (CNG) is meant to be a long-term replacement for the CryptoAPI, providing substitutes for all of the cryptographic primitives it offered. CNG supports all of the algorithms provided by the CryptoAPI, but goes much further and includes many new algorithms and a much more flexible design, providing developers with greater control over how cryptographic operations are performed and how algorithms work together to perform various operations. ]]> </description>
</item>
<item>
<title>Security Briefs: Active Directory Cache Dependencies</title>
<link>http://www.dotnetcat.com/news/Security/id/7593/</link>
<pubDate>Mon, 21 May 2007 19:00:00 -0500</pubDate>
<description> <![CDATA[ If you're not taking advantage of Active Directory, you should be. Learn the benefits from Keith Brown. ]]> </description>
</item>
<item>
<title>Top 10 Application Security Vulnerabilities in Web.config Files - Part One</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/7283/</link>
<pubDate>Wed, 02 May 2007 15:46:00 -0500</pubDate>
<description> <![CDATA[ In part one of this two part article, you will learn about five of the top ten &quot;worst offenders&quot; of misconfigurations of application security that can cause overall problems for ASP.NET Web-based applications. Learn more about how to secure the Web.config files of an ASP.NET application. ]]> </description>
</item>
<item>
<title>Next Generation of Cryptography for Microsoft Windows Vista</title>
<link>http://www.dotnetcat.com/news/Security/id/7264/</link>
<pubDate>Mon, 30 Apr 2007 22:45:00 -0500</pubDate>
<description> <![CDATA[ The Cryptography API: Next Generation(CNG) is a new and agile framework in Windows Vista, which implements an extensible provider model that allows you to load a provider by specifying the required cryptographic algorithm rather than having to hardcode a specific provider.

The advantage is that an algorithm provider can be replaced or upgraded and you will not have to change your code in any way to use the new provider. Also, if some algorithm is determined to be unsafe in the future, a more secure version of that algorithm can be installed with no effect to your code. To facilitate this, you load a CNG provider by identifying the cryptographic algorithm that you require, not the specific provider. Most of the CNG APIs require a provider or an object created by a provider.

In this article, I try to describe the new security feature Cryptography API: Next Generation(CNG) and compare it with an RSA and AES samples, both managed and unmanaged, using &quot;Crypto API&quot; (CAPI before Vista) and how it can be implemented using CNG in Windows Vista. Managed version of CNG is yet to come, if you feel like you want more, wait for the next release of Visual Studio &quot;Orcas&quot;. ]]> </description>
</item>
<item>
<title>Elliptic Curve Diffie Hellman Cryptography</title>
<link>http://www.dotnetcat.com/news/Security/id/7265/</link>
<pubDate>Mon, 30 Apr 2007 22:07:00 -0500</pubDate>
<description> <![CDATA[ Elliptic Curve cryptography is the current standard for public key cryptography, and is being promoted by the National Security Agency as the best way to secure private communication between parties. Microsoft has both good news and bad news when it comes to using Elliptic Curve encryption algorithms. The good news is that it is natively supported in the Vista operating system through CNG (Cryptography API Next Generation). The bad news is that a managed library for using EC will not be available until the release of Visual Studio Orcas, which is currently slated for the end of 2007 or the beginning of 2008.

The code in the attached project attempts to fill this gap by providing a wrapper class that will give you access to the underlying Vista Crypto API, as well as offer simple methods for leveraging the Elliptic Curve algorithms. It is intended for educational purposes only, however, and requires much more testing and refactoring before it can be used in any serious way. In other words, please play with it, copy it, and manipulate it in any way you like, but don't use it in its current form to lift any heavy machinery. ]]> </description>
</item>
<item>
<title>An easy way to use certificates for WCF security</title>
<link>http://www.dotnetcat.com/news/Security/id/7271/</link>
<pubDate>Mon, 30 Apr 2007 14:34:00 -0500</pubDate>
<description> <![CDATA[ An easy solution to use certificates on Windows Communication Foundation, loading the certificates from files. ]]> </description>
</item>
<item>
<title>SQLCLR Security and Designing for Reuse</title>
<link>http://www.dotnetcat.com/news/Database/id/7470/</link>
<pubDate>Thu, 26 Apr 2007 19:00:00 -0500</pubDate>
<description> <![CDATA[ Bringing the Common Language Runtime (CLR) into SQL Server presents an entirely new set of challenges with regard to privilege and some of the rules that SQL Server developers are used to do not completely translate. Simple grant/deny/revoke logic still applies, but the CLR also brings its own set of specialized permissions, which require slightly different handling in order to properly manipulate.

By not carefully considering these issues when designing your SQLCLR code base, you may be allowing your code too much access.
This article focuses on what the SQLCLR permission sets do to control security and reliability, and what you need to understand when working with them in order to design a system that takes advantage of least privilege. By not carefully considering these issues when designing your SQLCLR code base, you may allow your code too much access, thereby creating potential vectors for security problems down the road.. ]]> </description>
</item>
<item>
<title>Security Briefs: Events in Windows Vista</title>
<link>http://www.dotnetcat.com/news/Security/id/7122/</link>
<pubDate>Tue, 10 Apr 2007 19:00:00 -0500</pubDate>
<description> <![CDATA[ This month Keith Brown digs into the new eventing system in Windows Vista, Windows Eventing 6.0. ]]> </description>
</item>
<item>
<title>Using the Local Security Authority to Enumerate User Sessions in .NET</title>
<link>http://www.dotnetcat.com/news/Security/id/7014/</link>
<pubDate>Wed, 28 Mar 2007 14:14:00 -0500</pubDate>
<description> <![CDATA[ The Local Security Authority, or LSA, has been included in the Windows operating systems since Windows 2000. LSA is responsible for account validation, management of local security policy, auditing, maintaining sessions and the generation of tokens for login and impersonation. At times you may want to determine what users are logged onto a machine, be it local, remote or system service accounts. LSA maintains a range of information, including usernames, domain information, login times, the authentication package used, SIDs and terminal services session information. Unfortunately, .NET doesn't provide a simple way to interact with LSA, so you have to Interop with the LSA functions directly to enumerate user sessions and extract data. ]]> </description>
</item>
<item>
<title>PKCS Standards and .NET Framework</title>
<link>http://www.dotnetcat.com/news/Security/id/6948/</link>
<pubDate>Sun, 18 Mar 2007 07:27:00 -0500</pubDate>
<description> <![CDATA[ The article describes what is standardized in the PKCS (Public Key Cryptographic Standards) standards and their implementation in .NET 1.1 Framework. ]]> </description>
</item>
<item>
<title>Identity: Secure Your ASP.NET Apps And WCF Services With Windows CardSpace</title>
<link>http://www.dotnetcat.com/news/Security/id/6900/</link>
<pubDate>Mon, 12 Mar 2007 19:00:00 -0500</pubDate>
<description> <![CDATA[ Windows CardSpace replaces traditional username and password authentication with a tool that helps users better manage their digital identities and helps shield users from various forms of identity attack such as phishing. Mich&egrave;le Leroux Bustamante explains how to integrate Windows CardSpace with your ASP.NET applications and Windows Communication Foundation services. ]]> </description>
</item>
<item>
<title>Improve Manageability through Event Logging</title>
<link>http://www.dotnetcat.com/news/Security/id/6911/</link>
<pubDate>Mon, 12 Mar 2007 19:00:00 -0500</pubDate>
<description> <![CDATA[ When something goes wrong, a manageable application will tell the administrator how to fix the problem. The Windows Event Log can provide the necessary information.
 ]]> </description>
</item>
<item>
<title>SQL Server CLR Integration Part 1: Security</title>
<link>http://www.dotnetcat.com/news/Database/id/6840/</link>
<pubDate>Sun, 04 Mar 2007 10:43:00 -0600</pubDate>
<description> <![CDATA[ Understanding how the SQL Server and CLR security models work together to keep your database secure ]]> </description>
</item>
<item>
<title>Protect Your Downloadable Files Using HTTP Handlers</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/6801/</link>
<pubDate>Thu, 01 Mar 2007 18:00:00 -0600</pubDate>
<description> <![CDATA[ This article attacks a problem for which I have heard many solutions: How can I offer file downloads on the Internet and protect them from unauthorized downloading? There are many answers to this problem, but some are not without their own problems. In this article, I’ll review some of the techniques commonly used by software vendors, and then show you my solution for this.

 ]]> </description>
</item>
<item>
<title>A Programmer's Exploration of Vista's User Account Control</title>
<link>http://www.dotnetcat.com/news/Security/id/6818/</link>
<pubDate>Thu, 01 Mar 2007 15:47:24 -0600</pubDate>
<description> <![CDATA[ Vista's User Account Control (UAC) improves security, but making it work smoothly requires a little more developer work. Find out what you need to know to code Vista UAC-aware applications. ]]> </description>
</item>
<item>
<title>Bullet Proof Cookies</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/6796/</link>
<pubDate>Wed, 28 Feb 2007 15:41:00 -0600</pubDate>
<description> <![CDATA[ You always read how cookies play an important role in the security of a web application. Cookies have several uses in web applications, for instance ASP.NET itself uses cookies to identify a session, some sites use cookies to implement the feature of &quot;remember me&quot; when you log in to their site, other sites save user preferences in cookies. I am going to talk briefly about cookies and what makes them vulnerable to attacks, I will give some example of how cookies can be abused and finally I will talk about what we need to do to make our cookies bullet proof to defeat each one of the vulnerabilities. ]]> </description>
</item>
<item>
<title>Using Asymmetric Encryption and Digital Signatures in a SQL Server 2005 Database</title>
<link>http://www.dotnetcat.com/news/Security/id/6781/</link>
<pubDate>Tue, 27 Feb 2007 18:00:00 -0600</pubDate>
<description> <![CDATA[ 
In this article we start with a look at the T-SQL commands for performing asymmetric encryption
and decryption. Next, we discuss using digital signatures as a means for ensuring the integrity of the encrypted data.
This article concludes with an ASP.NET 2.0 website example that ties together the lessons learned throughout this article
series. Specifically, the database used by this ASP.NET application stores customer information with the customer's credit
card information encrypted. An ASP.NET page provides a means to view the sensitive information in plaintext as well as a means
to add new customers to the database with the credit card information properly encrypted.
 ]]> </description>
</item>
<item>
<title>Get info about local digital certificates with WSE 2.0 and .NET</title>
<link>http://www.dotnetcat.com/news/Security/id/6784/</link>
<pubDate>Tue, 27 Feb 2007 15:00:00 -0600</pubDate>
<description> <![CDATA[ This article describes how to get information about digital certificates stored on your local machine. It also shows how to search certificate by name and retrieve certificate hash.
 ]]> </description>
</item>
<item>
<title>Using Symmetric Encryption in a SQL Server 2005 Database</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/6742/</link>
<pubDate>Tue, 20 Feb 2007 18:00:00 -0600</pubDate>
<description> <![CDATA[ 
As the attacks in which hackers use become more and more sophisticated, and the programs in which they attack become
increasingly complex, encryption is becoming the last line of defense in database management system (DBMS) security.

In this article we will look at how, specifically, to encrypt the data in a SQL Server 2005 database
using symmetric encryption techniques. We'll start with examining the facilities for managing keys in SQL Server and then
explore symmetric encryption in SQL Server 2005.

 ]]> </description>
</item>
<item>
<title>An Overview of Cryptographic Systems and Encrypting Database Data</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/6690/</link>
<pubDate>Tue, 13 Feb 2007 18:00:00 -0600</pubDate>
<description> <![CDATA[ 
As the attacks in which hackers use become more and more sophisticated, and the programs in which they attack become increasingly
complex, encryption is becoming the last line of defense in database management system (DBMS) security. Since Microsoft
announced their Trustworthy Computing security initiatives four years ago, the industry has been waiting to see how these
initiatives would be implemented in upcoming products. With the introduction of Microsoft's newest DBMS, SQL Server 2005,
it does indeed seem as though they have provided what they have promised.

What follows is a two-part article series that provides an in-depth examination of encrypting data in SQL Server 2005. In
this article we will exploring key challenges facing database systems and the motivations for providing robust encryption
mechanisms directly within the database system. We will also look at encryption fundamentals and SQL Server 2005's encryption
capabilities.
 ]]> </description>
</item>
<item>
<title>.NET Encryption Simplified</title>
<link>http://www.dotnetcat.com/news/Security/id/6564/</link>
<pubDate>Mon, 29 Jan 2007 04:17:00 -0600</pubDate>
<description> <![CDATA[ A simple, string-oriented class for symmetric encryption, asymmetric encryption, and hashing. ]]> </description>
</item>
<item>
<title>Programatically disable/enable windows firewall</title>
<link>http://www.dotnetcat.com/news/Security/id/6528/</link>
<pubDate>Wed, 24 Jan 2007 18:29:00 -0600</pubDate>
<description> <![CDATA[ This article teaches you how to disable and enable your windows firewall programatically ]]> </description>
</item>
<item>
<title>Fundamentals of WCF Security</title>
<link>http://www.dotnetcat.com/news/Security/id/6432/</link>
<pubDate>Tue, 16 Jan 2007 20:31:58 -0600</pubDate>
<description> <![CDATA[ The labyrinth of security features for WCF is intricate and at times even overwhelming. At its core, however, are a basic set of security principals for authentication, authorization, and message transfer protection. ]]> </description>
</item>
<item>
<title>.NET Application Domains</title>
<link>http://www.dotnetcat.com/news/Security/id/6421/</link>
<pubDate>Mon, 15 Jan 2007 11:46:05 -0600</pubDate>
<description> <![CDATA[ Explains advantages of using application domains features in .NET. Include two Visual Studio .NET sample projects with source code. ]]> </description>
</item>
<item>
<title>Support Certificates In Your Applications With The .NET Framework 2.0</title>
<link>http://www.dotnetcat.com/news/Security/id/6704/</link>
<pubDate>Sun, 14 Jan 2007 18:00:00 -0600</pubDate>
<description> <![CDATA[ Certificates are used in many places across the Microsoft .NET Framework, from secure communication to code signing to security policies. The .NET Framework 2.0 introduced revamped support for certificates and it added a completely new namespace for standards-compliant cryptographic operations with certificates. In this article, I will discuss the background for certificates and the Windows Certificate Store. I'll also show you how to work with the certificate APIs and how they are used by the Framework to implement security features. ]]> </description>
</item>
<item>
<title>Validating ASP.NET Query Strings</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/6712/</link>
<pubDate>Sun, 14 Jan 2007 18:00:00 -0600</pubDate>
<description> <![CDATA[ Starting with version 1.1, ASP.NET preprocesses any posted data (forms and query string), looking for suspicious combinations of characters that may be exploited by XSS attackers. But this barrier is not a silver bullet and you have to take responsibility. If your pages use query string parameters, you need to ensure that they are properly validated before use. How do you do that?

In this column, I build an HTTP module that reads an XML file where you have hardcoded the expected structure of the query string. The module then validates the query string of any requested page against the given schema. And you don't need to touch the code of any page. ]]> </description>
</item>
<item>
<title>Securing Text Data in .NET</title>
<link>http://www.dotnetcat.com/news/Security/id/6171/</link>
<pubDate>Thu, 07 Dec 2006 23:54:00 -0600</pubDate>
<description> <![CDATA[ Discussion of securing text in an application. The example project contains a SecureString wrapper to make working with SecureString easier, and a textbox that directly manipulates a SecureString. ]]> </description>
</item>
<item>
<title>Tips on Using Protocol Transition</title>
<link>http://www.dotnetcat.com/news/Security/id/6219/</link>
<pubDate>Tue, 21 Nov 2006 18:00:00 -0600</pubDate>
<description> <![CDATA[ Now that Windows Server 2003 is  widely deployed, Keith Brown addresses questions from readers who are trying to use protocol transition to build secure gateways into their intranets.
 ]]> </description>
</item>
<item>
<title>Microsoft Anti-Cross Site Scripting Library V1.5</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/6039/</link>
<pubDate>Mon, 20 Nov 2006 18:04:46 -0600</pubDate>
<description> <![CDATA[ Cross-site scripting attacks are platform and browser independent, and can allow malicious users to perform malicious actions such as gaining unauthorized access to client data like cookies or hijacking sessions entirely.  Simple steps that developers can take to prevent XSS attacks in their ASP.NET applications include doing the following:

1. Validating and constraining input
2. Encoding output

For defense in depth, developers may wish to use the Microsoft Anti-Cross Site Scripting Library to encode output. This library differs from most encoding libraries in that it uses the &quot;principle of inclusions&quot; technique to provide protection against XSS attacks. This approach works by first defining a valid or allowable set of characters, and encodes anything outside this set (invalid characters or potential attacks). The principle of inclusions approach provides a high degree of protection against XSS attacks and is suitable for Web applications with high security requirements.
 ]]> </description>
</item>
<item>
<title>Hashing, MACs, and Digital Signatures in .NET</title>
<link>http://www.dotnetcat.com/news/Security/id/5941/</link>
<pubDate>Fri, 10 Nov 2006 08:20:01 -0600</pubDate>
<description> <![CDATA[ This article covers what the differences are between hashing, MAC and digital signatures. It presumes a certain level of knowledge about encryption methods especially the difference between symmetric and asymmetric encryption. The article does not cover how to perform encryption or about key management. There are some code examples on how to perform each of the technologies using C# in .NET v2.0.  ]]> </description>
</item>
<item>
<title>Using Enterprise Library in ASP.NET 2.0 Partial Trust Mode</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/5868/</link>
<pubDate>Tue, 31 Oct 2006 18:02:26 -0600</pubDate>
<description> <![CDATA[ The Enterprise Library Application Blocks aren't useful only in Windows Forms applications; you can use them in ASP.NET too by downloading a set of patch files and configuring the security settings appropriately. Find out how. ]]> </description>
</item>
<item>
<title>Online Article: Fundamentals of WCF Security</title>
<link>http://www.dotnetcat.com/news/Security/id/5772/</link>
<pubDate>Thu, 19 Oct 2006 19:00:00 -0500</pubDate>
<description> <![CDATA[ Windows Communication Foundation (WCF) is a secure, reliable, and scalable messaging platform for the .NET Framework 3.0.With WCF, SOAP messages can be transmitted over a variety of supported protocols including IPC (named pipes), TCP, HTTP and MSMQ. Like any distributed messaging platform, you must establish security policies for protecting messages and for authenticating and authorizing calls. This article will discuss how WCF accomplishes this.
 ]]> </description>
</item>
<item>
<title>Threat Modeling: Uncover Security Design Flaws Using The STRIDE Approach</title>
<link>http://www.dotnetcat.com/news/Security/id/5717/</link>
<pubDate>Wed, 11 Oct 2006 19:00:00 -0500</pubDate>
<description> <![CDATA[ Whenever you build a new system you should consider how an in&not;truder might go about attacking it and then build in appropriate defenses at design time. ]]> </description>
</item>
<item>
<title>Extending SDL: Documenting And Evaluating The Security Guarantees Of Your Apps</title>
<link>http://www.dotnetcat.com/news/Security/id/5720/</link>
<pubDate>Wed, 11 Oct 2006 19:00:00 -0500</pubDate>
<description> <![CDATA[ In this article, the author presents an extension to the Security Development Lifecycle Which could promote a better flow of information between users and designers of software security features.  ]]> </description>
</item>
<item>
<title>SQL Security: New SQL Truncation Attacks And How To Avoid Them</title>
<link>http://www.dotnetcat.com/news/Security/id/5721/</link>
<pubDate>Wed, 11 Oct 2006 19:00:00 -0500</pubDate>
<description> <![CDATA[ This article discusses some new threats to your SQL Web app that include modifying SQL statements or injecting SQL code even if the code has escaped the delimiting characters.  ]]> </description>
</item>
<item>
<title>Security Briefs: Limited User Problems and Split Knowledge</title>
<link>http://www.dotnetcat.com/news/Security/id/5730/</link>
<pubDate>Wed, 11 Oct 2006 19:00:00 -0500</pubDate>
<description> <![CDATA[ 
Why won't my simple Windows&reg; Communication Foundation service start when I run it as a non-administrator?
What is the best way to implement split knowledge and dual control of keys?
 ]]> </description>
</item>
<item>
<title>A simple but robust software protection and activation</title>
<link>http://www.dotnetcat.com/news/Security/id/5663/</link>
<pubDate>Fri, 06 Oct 2006 10:15:00 -0500</pubDate>
<description> <![CDATA[ A simple but robust software protection and activation. ]]> </description>
</item>
<item>
<title>Simple Password Manager Using System.Security</title>
<link>http://www.dotnetcat.com/news/Examples/id/5620/</link>
<pubDate>Fri, 29 Sep 2006 08:15:00 -0500</pubDate>
<description> <![CDATA[ Password Manager is a System.Security usage example using SecureString and SymmetricAlgorithms. ]]> </description>
</item>
<item>
<title>The Digital Signing Framework of the Open Packaging Conventions</title>
<link>http://www.dotnetcat.com/news/Security/id/5628/</link>
<pubDate>Mon, 25 Sep 2006 14:35:18 -0500</pubDate>
<description> <![CDATA[ Discusses the OPC Digital Signing Framework, providing an overview of the package components and supporting services, and examples of signing policy and its implementation. ]]> </description>
</item>
<item>
<title>Top 10 Security Vulnerabilities in .NET Configuration Files</title>
<link>http://www.dotnetcat.com/news/Security/id/5506/</link>
<pubDate>Tue, 19 Sep 2006 17:30:58 -0500</pubDate>
<description> <![CDATA[ Developers often concentrate on writing secure code but leave security vulnerabilities in application configuration files. Discover the most common configuration security problems—and how to avoid them. ]]> </description>
</item>
<item>
<title>Removing strong-signing from assemblies at file level (byte patching)</title>
<link>http://www.dotnetcat.com/news/Security/id/5336/</link>
<pubDate>Mon, 28 Aug 2006 11:20:00 -0500</pubDate>
<description> <![CDATA[ This article describes how to remove strong signing from .NET assemblies without recompiling code. ]]> </description>
</item>
<item>
<title>Cryptography 101 for the .NET Framework</title>
<link>http://www.dotnetcat.com/news/Security/id/5262/</link>
<pubDate>Tue, 22 Aug 2006 20:27:00 -0500</pubDate>
<description> <![CDATA[ An introduction to key cryptographic concepts supported by the .NET Framework ]]> </description>
</item>
<item>
<title>patterns &amp; practices Guidance Explorer</title>
<link>http://www.dotnetcat.com/news/Software/id/5118/</link>
<pubDate>Fri, 14 Jul 2006 16:36:55 -0500</pubDate>
<description> <![CDATA[ What are the security and performance proven practices for .NET applications? You can use Guidance Explorer to find out. Guidance Explorer is a tool to help you find and use relevant patterns &amp; practices guidance. ]]> </description>
</item>
<item>
<title>Windows XP SP2 Firewall Controller</title>
<link>http://www.dotnetcat.com/news/Security/id/4894/</link>
<pubDate>Mon, 10 Jul 2006 15:32:00 -0500</pubDate>
<description> <![CDATA[ How to control a base firewall included in Windows XP SP2 using COM. ]]> </description>
</item>
<item>
<title>CLR Inside Out: Using strong name signatures</title>
<link>http://www.dotnetcat.com/news/Security/id/4712/</link>
<pubDate>Wed, 07 Jun 2006 19:00:00 -0500</pubDate>
<description> <![CDATA[ CLR Inside Out: Using strong name signatures ]]> </description>
</item>
<item>
<title>User Impersonation in .Net</title>
<link>http://www.dotnetcat.com/news/Security/id/4664/</link>
<pubDate>Tue, 06 Jun 2006 12:38:00 -0500</pubDate>
<description> <![CDATA[ This sample shows how to switch between security contexts within the same process. It also demostrates how this can be done on a single or multiple threads. ]]> </description>
</item>
<item>
<title>Strong And Fast Data Encryption With The CAST-128 Algorithm</title>
<link>http://www.dotnetcat.com/news/Security/id/4604/</link>
<pubDate>Sat, 27 May 2006 11:03:00 -0500</pubDate>
<description> <![CDATA[ An effective implementation of the CAST-128 algorithm (ECB and CBC modes) ]]> </description>
</item>
<item>
<title>The experience of using Spices.Obfuscator&amp;#58; Review of options,advises and recommendations</title>
<link>http://www.dotnetcat.com/news/Security/id/4609/</link>
<pubDate>Fri, 26 May 2006 16:40:12 -0500</pubDate>
<description> <![CDATA[ This article is devoted to consideration of practice with recommendations on how to use these options for protection not only against reverse engineering and deobfuscation, but also for protection of algorithms and data contained in .Net assemblies.&amp;#13;&amp;#10;Spices.Obfuscator is a tool for protecting different kinds of assemblies from managed C&amp;#43;&amp;#43; assemblies , ASP.Net, Windows.Forms and Compact.Framework assemblies.&amp;#13;&amp;#10;The Spices.Obfuscator tools can be customized by means of ObfuscationOptions which can be seen in Spices.Project for each project assembly. Open the assembly in Spices.Net, go to section Properties, open the property AssemblyList, and then open sub-properties to get the setting options of Obfuscator of each assembly. ]]> </description>
</item>
<item>
<title>Add Fingerprint Scan-based Security to Your .NET Applications Today</title>
<link>http://www.dotnetcat.com/news/Security/id/4608/</link>
<pubDate>Fri, 26 May 2006 13:03:53 -0500</pubDate>
<description> <![CDATA[ It wasn't all that long ago that biometric authentication seemed like the kind of sci-fi technology that might never be practical outside of top-secret government laboratories. But believe it or not, you can build a fingerprint scanner into any .NET application you like just by following these simple instructions.  ]]> </description>
</item>
<item>
<title>Security in the CLR World Inside SQL Server</title>
<link>http://www.dotnetcat.com/news/Database/id/4557/</link>
<pubDate>Mon, 22 May 2006 14:10:06 -0500</pubDate>
<description> <![CDATA[ Is running .NET Framework code within SQL Server 2005 exciting or a threat? Which is it? This article explores the security issues of SQLCLR code so that both developers and DBAs can make informed decisions about its use. ]]> </description>
</item>
<item>
<title>Encrypting configuration sections</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/4642/</link>
<pubDate>Fri, 19 May 2006 19:00:00 -0500</pubDate>
<description> <![CDATA[ Developers often store confidential information in the configuration files. Database connection strings, user names and passwords are some of the examples. One of the requested feature during ASP.NET 1.x days was to provide some way to easily encrypt and decrypt such information. Thankfully ASP.NET 2.0 fulfils this request in a flexible way... ]]> </description>
</item>
<item>
<title>.NET 2.0 Security Workshop</title>
<link>http://www.dotnetcat.com/news/Security/id/4320/</link>
<pubDate>Wed, 19 Apr 2006 10:06:49 -0500</pubDate>
<description> <![CDATA[ This is a self paced workshop designed to lead you through the benefits and features of .NET security. There are over 50 code examples and many more walkthroughs showing you how to use the .NET security classes and how to administer .NET security policy. The workshop covers code access security, role based security, access control lists, symmetric and asymmetric cryptography, certificates, CMS/PKCS, data protection APIs, and encrypting and signing XML. ]]> </description>
</item>
<item>
<title>Steganography 16 - Hiding additional files in a ZIP archive</title>
<link>http://www.dotnetcat.com/news/Security/id/4252/</link>
<pubDate>Sun, 16 Apr 2006 16:15:00 -0500</pubDate>
<description> <![CDATA[ How to zip and unzip files avoiding the central directory
 ]]> </description>
</item>
<item>
<title>Extreme ASP.NET: Keeping secrets in ASP.NET 2.0.</title>
<link>http://www.dotnetcat.com/news/Security/id/4217/</link>
<pubDate>Wed, 05 Apr 2006 19:00:00 -0500</pubDate>
<description> <![CDATA[ Storing configuration data securely was always difficult. But it's a whole lot easier now with a powerful new set of APIs in ASP.NET 2.0 that allow you to manage the ASP.NET configuration file programmatically. ]]> </description>
</item>
<item>
<title>Security Briefs: A deeper look at InfoCard.</title>
<link>http://www.dotnetcat.com/news/Security/id/4218/</link>
<pubDate>Wed, 05 Apr 2006 19:00:00 -0500</pubDate>
<description> <![CDATA[ What InfoCard is, what it isn't, and what it means for the future of business and personal security on the Web. ]]> </description>
</item>
<item>
<title>Using a NetworkStream with raw serialization, GZipStream and CryptoStream</title>
<link>http://www.dotnetcat.com/news/Security/id/4068/</link>
<pubDate>Sun, 26 Mar 2006 20:22:00 -0600</pubDate>
<description> <![CDATA[ Using a NetworkStream with raw serialization, GZipStream and CryptoStream ]]> </description>
</item>
<item>
<title>Secure File Download using Basic Authentication</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/4019/</link>
<pubDate>Sun, 19 Mar 2006 12:57:00 -0600</pubDate>
<description> <![CDATA[ Secure file download using basic authentication, the interesting part is that it maintains two separate entry points for uploading and downloading a file ]]> </description>
</item>
<item>
<title>Making TripleDES Simple in Visual Basic .NET</title>
<link>http://www.dotnetcat.com/news/Security/id/4013/</link>
<pubDate>Fri, 17 Mar 2006 10:43:00 -0600</pubDate>
<description> <![CDATA[ This is a simple wrapper class that provides an easy interface for encrypting and decrypting byte arrays and strings. ]]> </description>
</item>
<item>
<title>Switching Between HTTP and HTTPS Automatically: Version 2</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/4005/</link>
<pubDate>Thu, 16 Mar 2006 05:57:00 -0600</pubDate>
<description> <![CDATA[ An article on automatically switching between HTTP and HTTPS protocols without hard-coding absolute URLs. ]]> </description>
</item>
<item>
<title>Passing Information Securely Between ASP and ASP.NET</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/3967/</link>
<pubDate>Fri, 10 Mar 2006 15:09:50 -0600</pubDate>
<description> <![CDATA[ Many classic ASP applications exist side-by-side with newer ASP.NET applications, sometimes leading to a need to transfer or share information between the two. This article shows one method of transferring such information securely. ]]> </description>
</item>
<item>
<title>A CAPTCHA Control for ASP.NET 2</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/3928/</link>
<pubDate>Thu, 09 Mar 2006 07:32:00 -0600</pubDate>
<description> <![CDATA[ A CAPTCHA control that is simple, secure and easy to use. ]]> </description>
</item>
<item>
<title>Security Briefs: A First Look at InfoCard</title>
<link>http://www.dotnetcat.com/news/Security/id/3946/</link>
<pubDate>Wed, 08 Mar 2006 18:00:00 -0600</pubDate>
<description> <![CDATA[ Security Briefs: A First Look at InfoCard ]]> </description>
</item>
<item>
<title>Hasher v0.7</title>
<link>http://www.dotnetcat.com/news/Components/id/3825/</link>
<pubDate>Sat, 25 Feb 2006 20:01:04 -0600</pubDate>
<description> <![CDATA[ Hasher is a tool to help programmers implement standard hashing and checksum algorithms into their own software. Written entirely in C# and designed for use in the .NET Framework, Hasher providers a uniform interface to easily use any of the algorithms contained within this library in other programs.

Hasher is planned to encapsulate a wide variety of cryptographic hashing and checksum algorithms. Focusing on compatibility, speed, and ease-of-use, Classless.Hasher currently supports over 25 different algorithms including the &quot;basics&quot; such as CRC, MD5, and SHA, as well as others like HAVAL, Tiger, Snefru, and Whirlpool.  ]]> </description>
</item>
<item>
<title>Xenocode Postbuild 2006 allows .NET applications to run anywhere</title>
<link>http://www.dotnetcat.com/news/Software/id/3781/</link>
<pubDate>Wed, 22 Feb 2006 18:09:11 -0600</pubDate>
<description> <![CDATA[ Xenocode Postbuild 2006 breakthrough technology allows .NET applications to run on any Windows PC, with or without the Framework, counteracts decompilation and reverse engineering, optimizes application size and performance, and dramatically reduces test and support costs by eliminating &quot;DLL/versioning hell&quot;. ]]> </description>
</item>
<item>
<title>Online Article: Security in the CLR World Inside SQL Server</title>
<link>http://www.dotnetcat.com/news/Security/id/3627/</link>
<pubDate>Fri, 17 Feb 2006 02:00:00 -0600</pubDate>
<description> <![CDATA[ One of the major benefits of writing .NET code to run in the Common Language Runtime (CLR) hosted in any environment is code access security (CAS).CAS provides a code-based-rather than user-based-authorization scheme to prevent various kinds of luring and other code attacks. But how does that security scheme coexist with SQL Server 2005's own, newly enhanced security features? By default your .NET code is reasonably secure, but it's all too easy for the two security schemes to butt heads and cause you grief. In this article I'll look briefly at the concept behind CAS and a few new security features in SQL Server 2005, then explore how to make the two systems work for you instead of against you as you take advantage of these advanced programming features in SQL Server.
 ]]> </description>
</item>
<item>
<title>Encrypting Configuration Information in ASP.NET 2.0 Applications</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/3748/</link>
<pubDate>Tue, 14 Feb 2006 18:00:00 -0600</pubDate>
<description> <![CDATA[ 
When creating ASP.NET 2.0 applications, developers commonly store sensitive configuration information in the Web.config
file. The cannonical example is database connection strings, but other sensitive information included in the Web.config
file can include SMTP server connection information and user credentials, among others. While ASP.NET is configured, by default,
to reject all HTTP requests to resources with the .config extension, the sensitive information in Web.config
can be compromised if a hacker obtains access to your web server's file system. For example, perhaps you forgot to disallow 
anonymous FTP access to your website, thereby allowing a hacker to simply FTP in and download your Web.config file.
Eep.

Fortunately ASP.NET 2.0 helps mitigate this problem by allowing selective portions of the Web.config file to be 
encrypted, such as the  section, or some custom config section used by your application.
Configuration sections can be easily encrypted using code or aspnet_regiis.exe, a command-line program. Once
encrypted, the Web.config settings are safe from prying eyes. Furthermore, when retrieving encrypted congifuration
settings programmatically in your ASP.NET pages, ASP.NET will automatically decrypt the encrypted sections its reading. In short,
once the configuration information in encrypted, you don't need to write any further code or take any further action to use
that encrypted data in your application.

In this article we'll see how to programmatically encrypt and decrypt portions of the configuration settings and look at
using the aspnet_regiis.exe command-line program. We'll then evaluate the encryption options ASP.NET 2.0 offers. 
There's also a short discussion on how to encrypt configuration information in ASP.NET version 1.x. 
 ]]> </description>
</item>
<item>
<title>Custom MembershipProvider and RoleProvider Implementations that use Web Services</title>
<link>http://www.dotnetcat.com/news/Web-Services/id/570/</link>
<pubDate>Sat, 11 Feb 2006 19:47:00 -0600</pubDate>
<description> <![CDATA[ Custom MembershipProvider and RoleProvider Implementations that use Web Services in order to separate the application and database servers. ]]> </description>
</item>
<item>
<title>Cryptor - Encrypt Files With Rijndael 256 bit</title>
<link>http://www.dotnetcat.com/news/Examples/id/255/</link>
<pubDate>Fri, 20 Jan 2006 19:04:00 -0600</pubDate>
<description> <![CDATA[ A simple utility for encrypting files using 256 bit Rijndael (AES). Also, adds menu items to Windows Explorer's file context menu for easy access. ]]> </description>
</item>
<item>
<title>Security Briefs: Security Enhancements in the .NET Framework 2.0</title>
<link>http://www.dotnetcat.com/news/Security/id/2685/</link>
<pubDate>Fri, 20 Jan 2006 02:00:00 -0600</pubDate>
<description> <![CDATA[ The.NET Framework 2.0 got quite a few security enhancements. This month Keith takes you on a whirlwind tour of the goodies you'll find there. ]]> </description>
</item>
<item>
<title>WSE Security: Protect Your Web Services Through The Extensible Policy Framework In WSE 3.0</title>
<link>http://www.dotnetcat.com/news/Web-Services/id/196/</link>
<pubDate>Tue, 10 Jan 2006 20:10:33 -0600</pubDate>
<description> <![CDATA[ This article describes the WSE policy framework, which allows you to describe constraints and requirements a Web service must enforce. Discussions include security scenarios in WSE 3.0 and extending the framework with custom constraints and requirements. ]]> </description>
</item>
<item>
<title>Web Service Security Guidance</title>
<link>http://www.dotnetcat.com/news/Web-Services/id/436/</link>
<pubDate>Wed, 14 Dec 2005 00:09:48 -0600</pubDate>
<description> <![CDATA[ Provides architectural, design, and implementation guidance for Web service security by using Web Services Enhancements (WSE) 3.0. Includes scenarios, patterns, decision matrices, and QuickStarts to help you make the most appropriate security decisions. ]]> </description>
</item>
<item>
<title>Security Briefs: Encrypting Without Secrets</title>
<link>http://www.dotnetcat.com/news/Security/id/2675/</link>
<pubDate>Tue, 13 Dec 2005 02:00:00 -0600</pubDate>
<description> <![CDATA[ Security Briefs: Encrypting Without Secrets ]]> </description>
</item>
<item>
<title>Online Article: Manage Custom Security Credentials the Smart (Client) Way</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/370/</link>
<pubDate>Fri, 28 Oct 2005 03:00:00 -0500</pubDate>
<description> <![CDATA[ Online Article: Manage Custom Security Credentials the Smart (Client) WayBoth Internet and intranet applications often require a custom store for user accounts and roles. ASP.NET 2.0 provides an out-of-the-box provider model as well as a SQL Sever database just for that propose. Unfortunately, the only way to administer the credentials databases is via Visual Studio 2005, and only for local Web applications. This article presents a full-blown custom security management application that administrators can use. The application wraps the ASP.NET 2.0 providers with a Web service and even adds missing features. This article presents the design approaches, challenges, and techniques involved in developing such an application. The article also walks you through some powerful yet useful techniques such as interface-based Web services, reflection-based Web service compatibility, advanced C# 2.0, Web services security, and Web services transactions. ]]> </description>
</item>
<item>
<title>Are You in the Know? Find Out What's New with Code Access Security in the .NET Framework 2.0</title>
<link>http://www.dotnetcat.com/news/Security/id/431/</link>
<pubDate>Tue, 11 Oct 2005 19:02:16 -0500</pubDate>
<description> <![CDATA[ Code access security (CAS) is based on the identity of the code that is running. In this article, Mike Downen discusses the role of CAS in .NET, and outlines some key new features and changes in CAS for the .NET Framework 2.0. ]]> </description>
</item>
<item>
<title>Do You Trust It?&nbsp;Discover Techniques for Safely Hosting Untrusted Add-Ins with the .NET Framework 2.0</title>
<link>http://www.dotnetcat.com/news/Addins/id/2704/</link>
<pubDate>Tue, 11 Oct 2005 03:00:00 -0500</pubDate>
<description> <![CDATA[ When you allow your application to run arbitrary code through an add-in, you may expose users to unknown code, running the risk that malicious code will use your application as an entry point into the user's data. There are several techniques you can use to reduce the attack surface of your application, which Shawn Farkas discusses here. ]]> </description>
</item>
<item>
<title>Are You Protected?&nbsp;Design and Deploy Secure Web Apps with ASP.NET 2.0 and IIS 6.0</title>
<link>http://www.dotnetcat.com/news/Security/id/2705/</link>
<pubDate>Tue, 11 Oct 2005 03:00:00 -0500</pubDate>
<description> <![CDATA[ Ensuring the security of a Web application is critical and requires careful planning throughout the design, development, deployment, and operation phases. It is not something that can be slapped onto an existing application. In this article, Michael Volodarsky outlines best practices that allow you to take advantage of the security features of ASP.NET 2.0 and IIS 6.0 to build and deploy more secure Web applications. ]]> </description>
</item>
<item>
<title>Who Goes There?&nbsp;Upgrade Your Site's Authentication with the New ASP.NET 2.0 Membership API</title>
<link>http://www.dotnetcat.com/news/ASP.NET/id/2706/</link>
<pubDate>Tue, 11 Oct 2005 03:00:00 -0500</pubDate>
<description> <![CDATA[ Here Dino Esposito and Andrea Saltarello cover the plumbing of the Membership API and its inherently extensible nature, based on pluggable providers. To demonstrate the features, they take an existing ASP.NET 1.x authentication mechanism and port it to ASP.NET 2.0, exposing the legacy authentication mechanism through the new Membership API. ]]> </description>
</item>
<item>
<title>What Gives You the Right?&nbsp;Combine the Powers of AzMan and WSE 3.0 to Protect Your Web Services</title>
<link>http://www.dotnetcat.com/news/Web-Services/id/2707/</link>
<pubDate>Tue, 11 Oct 2005 03:00:00 -0500</pubDate>
<description> <![CDATA[ In this article, Niels Flensted-Jensen demonstrates how you can combine new and existing Microsoft technologies with minimal new code to provide flexible authorization for individual Web service methods. Windows 2003 Authorization Manager, Web Service Enhancements 3.0, and Enterprise Library all play a part. ]]> </description>
</item>
<item>
<title>How Do They Do It?&nbsp;A Look Inside the Security Development Lifecycle at Microsoft</title>
<link>http://www.dotnetcat.com/news/Security/id/2708/</link>
<pubDate>Tue, 11 Oct 2005 03:00:00 -0500</pubDate>
<description> <![CDATA[ In this article, Microsoft security expert Michael Howard outlines how to apply the Security Development Lifecycle to your own software development processes. He explains how you can take some of the lessons learned at Microsoft when implementing SDL and use them in your own development process. ]]> </description>
</item>
<item>
<title>Editor's Note: Many Levels of Security</title>
<link>http://www.dotnetcat.com/news/Security/id/2709/</link>
<pubDate>Tue, 11 Oct 2005 03:00:00 -0500</pubDate>
<description> <![CDATA[ Editor's Note: Many Levels of Security ]]> </description>
</item>
<item>
<title>Security Briefs: Security Features in WSE 3.0</title>
<link>http://www.dotnetcat.com/news/Security/id/2717/</link>
<pubDate>Tue, 11 Oct 2005 03:00:00 -0500</pubDate>
<description> <![CDATA[ Security Briefs: Security Features in WSE 3.0 ]]> </description>
</item>
<item>
<title>Learning Paths for Security</title>
<link>http://www.dotnetcat.com/news/Security/id/433/</link>
<pubDate>Tue, 04 Oct 2005 20:55:41 -0500</pubDate>
<description> <![CDATA[ Use these learning paths to find a range of Microsoft training references and resources on security threats and appropriate countermeasures. These paths provide information on security planning, prevention, detection, and response. ]]> </description>
</item>
<item>
<title>High Availability: Keep Your Code Running with the Reliability Features of the .NET Framework</title>
<link>http://www.dotnetcat.com/news/Security/id/2721/</link>
<pubDate>Tue, 13 Sep 2005 03:00:00 -0500</pubDate>
<description> <![CDATA[ Reliability requires the capacity to execute a sequence of operations in a deterministic way, even under exceptional conditions. This allows you to ensure that resources are not leaked and that you can maintain state consistency without relying on application domain unloading (or worse, process restarts) to fix any corrupted state. Unfortunately, in the.NET Framework, not all exceptions are deterministic and synchronous, which makes it difficult to write code that is always deterministic in its ability to execute a predetermined sequence of operations. In this article Stephen Toub will show you why, and explore features of the .NET Framework 2.0 that help you to mitigate these situations and write more reliable code. ]]> </description>
</item>
<item>
<title>Security Briefs: Credentials and Delegation</title>
<link>http://www.dotnetcat.com/news/Security/id/2750/</link>
<pubDate>Tue, 09 Aug 2005 03:00:00 -0500</pubDate>
<description> <![CDATA[ Security Briefs: Credentials and Delegation ]]> </description>
</item>
<item>
<title>Hackers Beware: Keep Bad Guys at Bay with the Advanced Security Features in SQL Server 2005</title>
<link>http://www.dotnetcat.com/news/Database/id/2786/</link>
<pubDate>Tue, 10 May 2005 03:00:00 -0500</pubDate>
<description> <![CDATA[ Get a peek at the new security features in SQL Server 2005 from a developer's point of view. While there are lots of admin enhancements, there are also plenty of dev-specific security improvements you can take advantage of, such as endpoint authentication and support for the security context of managed code that executes on the server. Here Don Kiely elucidates. ]]> </description>
</item>
<item>
<title>Security Briefs: Customizing GINA, Part 2</title>
<link>http://www.dotnetcat.com/news/Security/id/2801/</link>
<pubDate>Tue, 10 May 2005 03:00:00 -0500</pubDate>
<description> <![CDATA[ Security Briefs: Customizing GINA, Part 2 ]]> </description>
</item>
<item>
<title>Security Briefs: Customizing GINA, Part 1</title>
<link>http://www.dotnetcat.com/news/Security/id/2819/</link>
<pubDate>Tue, 12 Apr 2005 03:00:00 -0500</pubDate>
<description> <![CDATA[ Security Briefs: Customizing GINA, Part 1 ]]> </description>
</item>
<item>
<title>Security: Manipulate Privileges in Managed Code Reliably, Securely, and Efficiently</title>
<link>http://www.dotnetcat.com/news/Security/id/2844/</link>
<pubDate>Tue, 15 Feb 2005 02:00:00 -0600</pubDate>
<description> <![CDATA[ When the author was faced with implementing support for changing a security descriptor on an object, he noticed there was not support for that operation in .NET. So he devised two solutions to the problem: the first, simpler one, is tailored to the .NET Framework 1.1 and can be used today. The second solution incorporates several advanced features available only in the .NET Framework 2.0. Both are presented here. ]]> </description>
</item>
</channel>
</rss> 