.NET news » Search results

How to configure IIS in order to enable the use of Named Kernel Objects in Web Services.

The.NET Framework 2.0 got quite a few security enhancements. This month Keith takes you on a whirlwind tour of the goodies you'll find there.

This article describes the WSE policy framework, which allows you to describe constraints and requirements a Web service must enforce. Discussions include security scenarios in WSE 3.0 and extending the framework with custom constraints and requirements.

Provides architectural, design, and implementation guidance for Web service security by using Web Services Enhancements (WSE) 3.0. Includes scenarios, patterns, decision matrices, and QuickStarts to help you make the most appropriate security decisions.

Security Briefs: Encrypting Without Secrets

Online Article: Manage Custom Security Credentials the Smart (Client) Way

Both Internet and intranet applications often require a custom store for user accounts and roles. ASP.NET 2.0 provides an out-of-the-box provider model as well as a SQL Sever database just for that propose. Unfortunately, the only way to administer the credentials databases is via Visual Studio 2005, and only for local Web applications. This article presents a full-blown custom security management application that administrators can use. The application wraps the ASP.NET 2.0 providers with a Web service and even adds missing features. This article presents the design approaches, challenges, and techniques involved in developing such an application. The article also walks you through some powerful yet useful techniques such as interface-based Web services, reflection-based Web service compatibility, advanced C# 2.0, Web services security, and Web services transactions.

Code access security (CAS) is based on the identity of the code that is running. In this article, Mike Downen discusses the role of CAS in .NET, and outlines some key new features and changes in CAS for the .NET Framework 2.0.

Ensuring the security of a Web application is critical and requires careful planning throughout the design, development, deployment, and operation phases. It is not something that can be slapped onto an existing application. In this article, Michael Volodarsky outlines best practices that allow you to take advantage of the security features of ASP.NET 2.0 and IIS 6.0 to build and deploy more secure Web applications.

In this article, Microsoft security expert Michael Howard outlines how to apply the Security Development Lifecycle to your own software development processes. He explains how you can take some of the lessons learned at Microsoft when implementing SDL and use them in your own development process.

Editor's Note: Many Levels of Security