Building Secure ASP.NET Applications Authentication, Authorization, and Secure Communication

Аннотация

This guide presents a practical, scenario driven approach to designing and building secure ASP.NET applications for Windows 2000 and version 1.0 of the .NET Framework. It focuses on the key elements of authentication, authorization and secure communication within and across the tiers of distributed .NET Web applications. The information in this guide applies to: ● .NET Framework Version 1.0 Service Pack 2 ● ASP.NET ● Enterprise Services ● Web Services ● .NET Remoting ● ADO.NET ● Visual Studio .NET ● SQL Server 2000 Service Pack 2 ● Windows 2000 Service Pack 3 Recommendations and sample code in the guide were built and tested using Visual Studio .NET and validated on servers running Windows 2000 Advanced Server SP 3, .NET Framework SP 2, and SQL Server 2000 SP 2. This guide focuses on: ● Authentication (to identify the clients of your application) ● Authorization (to provide access controls for those clients) ● Secure communication (to ensure that messages remain private and are not altered by unauthorized parties) Security is a broad topic. Research has shown that early design of authentication and authorization eliminates a high percentage of application vulnerabilities. Secure communication is an integral part of securing your distributed application to protect sensitive data, including credentials, passed to and from your application, and between application tiers.There are many technologies used to build .NET Web applications. To build effective application-level authentication and authorization strategies, you need to understand how to fine-tune the various security features within each product and technology area, and how to make them work together to provide an effective, defense-in-depth security strategy. This guide will help you do just that.