Dot Net Monkey

Some more links to writing secure code

Keith Brown has written an introductory article about Code Access Security (CAS).  This is something that all .NET developers should look at (me included).  Check it out here.

Related Resources
An Introduction to Code Access Security

I've done a little playing around with the Enterprise Library and it's way cool.  Thanks MS!  There are already some great resources out there, so if you haven't played around with Enterprise Library do so IMEMDIATELY!

Here are some resources for you:

• Enterprise Library Demonstration and Powerpoint Presentation - Doug Rohrer's presentation to the Cincinnati .Net users group meeting as well as some code
• Ohad Israeli and Ido Samuelson C# user group presentation - Don't freak out about the Hebrew on the first few slides, it's just there to throw you! 
• Tom Hollander bangs on about Instrumentation in Enterprise Library - Which is a good thing.

Everyone loves a good fiddle, and if you say you don't then you are probably lying.

Okay, enough shinanigans!  Fiddler is a Microsoft PowerToy that slots itself nicely into your HTTP stream as a proxy allowing you to have a look at all that traffic going to and fro.

There is a good MSDN article about configuring and running Fiddler which is well worth a read. Also from the Fiddler site there are some pointers to some good references.  Such as:

• HTTP Response Codes - pretty handy for working out what a 404 really means
• Header Field Definitions - understand what all that crazy header stuff means
• HTTP 1.1 Specification - if you read this you are a geek! (no exceptions)

So there you go, lots of great stuff about fiddling with yourself.

Related Resources
Fiddler Powertoy
MSDN Article - Fiddler PowerToy Part 1: HTTP Debugging
HTTP Response Codes
Header Field Definitions
HTTP 1.1 Specifications

I have just been listening to Joe Stagner's Webcast on Security and quite enjoying it.  At the moment the Digital Blackbelt series of webcasts is still very much in the early days but Joe is a great presenter and the series promises much.  Couple of things to take away from the presentation are:

• Establish threats early
• Design Security into the apps (hard to retro-fit)
• Try and get security as part of the practice
• Read some good books about security

Related Resources
Microsoft Thread Modeling Tool
Microsoft Security Developer Center
Microsoft Threat Modeling Website
Digital Blackbelt Website

Keith Brown has written a great introductory article about Code Access Security (CAS) in .NET. His conclusion is:

Deploying code over a network is dangerous without a comprehensive security system to verify and constrain that code, and Code Access Security is Microsoft's solution to the problem. It's a flexible, if somewhat complex beast, and as a developer working on smart clients, you should learn all you can about it, as it will play a big role in your life!

I think he's right so you should go read this article now.

Related Resources
An Introduction to Code Access Security