This one-day instructor-led clinic provides students with knowledge and skills essential for the creation of applications with enhanced security. Students will learn about the need for implementing security at every stage of the development process and best practices for applying security principles. Students will also learn how to use established threat modeling methodologies and tools with other best practices to minimise vulnerabilities and limit damage from attacks. Finally, students will learn how to implement security features to enhance security for Web applications and Web services that are built by using Microsoft ASP.NET.
After completing this clinic, students will be able to:
• Understand the historical implications of Trustworthy Computing.
• Identify potentially hostile applications.
• Identify common types of attacks.
• Understand the consequences of poor security.
• Recognize examples of security intrusions.
• Identify challenges involved in implementing security.
• Understand the need for process improvement throughout the development process.
• Describe the security framework.
• Understand the secure product development timeline.
• Describe the principles of designing with security in mind.
• Understand the importance of data security.
• Identify threat scenarios.
• Target potential sources of threats.
• Describe common types of attacks.
• Describe Microsoft .NET Framework security features.
• Explain how code access security works.
• Explain how role-based security works.
• Explain how to use cryptography to sign and verify data.
• Enhance security for ASP.NET Web applications.
• Enhance security for ASP.NET Web services.
• Apply appropriate tips for writing secure code with the .NET Framework.
Session 1: Essentials of Application Security
This session provides the knowledge and skills essential for the creation of applications with enhanced security. The session covers important security concepts and the need for implementing security at every stage of the development process. Additionally, this session discusses how to use various security technologies to increase data and communications security and describes the security enhancements included with Windows XP Service Pack 2.
Topics
• The Importance of Application Security
• Secure Application Development Practices
• Security Technologies
• Secure Development Guidelines
Session 2: Writing Secure Code – Best Practices
This session identifies best practices for applying security principles throughout the development process. The session also describes established threat modeling methodologies and tools and how they can be applied with other best practices to minimize vulnerabilities and limit damage from attacks.
Topics
• Secure Development Process
• Threat Modeling
• Risk Mitigation
• Security Best Practices
Session 3: Writing Secure Code – Threat Defense
This session builds upon existing knowledge of secure coding best practices and threat modeling to identify a variety of threat scenarios. The session covers effective strategies for defending common security threats such as buffer overruns, cross-site scripting, SQL injection, and denial of service attacks.
Topics
• The Need For Secure Code
• Defending Against Memory Issues
• Defending Against Arithmetic Errors
• Defending Against Cross-Site Scripting
• Defending Against SQL Injection
• Defending Against Canonicalization Issues
• Defending Against Cryptography Weaknesses
• Defending Against Unicode Issues
• Defending Against Denial of Service
Session 4: Implementing Application Security Using the .NET Framework
This session describes how to implement additional security features for applications that are built on the .NET Framework. The session describes how to use both code access security and role-based security to limit vulnerabilities and how to use the cryptographic provider support in the .NET Framework to encrypt and sign data. In addition, the session explains how to secure Web applications and Web services that are built by using ASP.NET.
Topics
• .NET Framework Security Features
• Code Access Security
• Role-Based Security
• Cryptography
• Securing ASP.NET Web Applications
• Securing ASP.NET Web Services
About Microsoft Clinics
Microsoft Official Clinic learning products provide students with technical information on Microsoft products or technologies while discussing real-world considerations for their implementation. Clinics highlight features and functionality through product demonstrations.
Attendees will be professional developers who are responsible for designing and developing applications, components, clients, or back-end data services written in Microsoft Visual Basic, Microsoft Visual C++, or C#.
Before attending this clinic, students must have:
• Development experience with Microsoft Visual Basic, Microsoft Visual C++, or C#
• Experience building Microsoft Windows or Web applications using the .NET Framework
