Ten Things To Think About When Developing Secure Code

Fail Safe - Your application must always fail safe. That is to say if it encounters a situation and it can no longer proceed, it must deny access to the resource. For example, if a firewall can not validate the action that is being requested by the requester, it should reject the operation; this is known as fail close or fail safe.

Secure the Weakest Link – The security of an application is that of its weakest link thus, it is important that all components in the application are secured and not just the operating system or database server. This also means that as a developer you must protect any resources your code owns or is responsible for.

Security Through Obscurity Does Not Work – Obscurity should not be used as the only or primary security mechanism.

Simplicity - Complexity increases the potential risk of problems. Application architecture and implementations should be as simple as is practical. This also makes it easy to do the right thing.
End to End security – Where data requires protection during transportation, it should be enforced from the sender to the recipient (end to end).

Compartmentalize - Applications should compartmentalize user access. Compartmentalization provides user access to data and functions that they require and restricts them from accessing data or functions they do not need.

Defense in Depth - Applications should use multiple layers of security. This ensures that if one security mechanism is vulnerable to an attack, an additional layer will still enforce an adequate security policy. Password files for example, should be restricted by access control lists and encryption. Similarly even if data is validated, the use of stored procedures or prepared SQL statements is strongly recommended since it adds an additional layer of defense.

Least Privilege – Applications should run with the minimum amount of system privileges that they need to function. Where elevated privileges are required they should be granted for the minimum period of time they are required. A similar principle is the “need to know” principle. Ensure that only the minimum number of people have administrative level access to production web, database and application servers.

Trust but Verify – Applications need to trust other applications or objects on the same host or on the network, however, they must always verify the source they are trusting. The same also applies to users and their actions. For instance, before performing any administrative action, it is important to check that the requesting user is indeed an administrator authorized to request such an action.

Think Strategically – There are no security silver bullets. Security requires constant monitoring and improvement and is not somebody else’s responsibility. Pay special attention to architecting the right solution so that it maybe reused frequently. The use of software design patterns like Model-View-Controller (MVC) and frameworks like JAVA Struts are therefore strongly encouraged.


Attribution
This content was provided by Foundstone and prepared by Nick Murison.

SQL Server 2005 Hands-On Labs

Greetings,

Don't have a machine to spare for Beta testing. Don't want to go thru the messy install-test-wipe-install-test cycle? Try out the SQL Server 2005 hands-on labs.

SQL Server 2005 hands-on labs give you the opportunity to try out the new and improved features and technologies that the new version will make available to database developers.

/Gill

SQL Server is now at TechCenter

The SQL Server has it's own TechCenter at TechNet.
http://www.microsoft.com/technet/prodtechnol/sql/default.mspx.

/Gill

VSTO (Visual Studio Tool for Office) revisited

Previously i posted some information on VSTO (Visual Studio Tool for Office). In recent days during TechEd 2005 USA, it was announced that the VSTO would also now include Ooutlook support.

So here are tons of resources for working with OUTLOOK using VSTO :)

Download the Visual Studio 2005 Tools for Office – Outlook (Beta)
With the new managed Outlook add-in support, developers have a framework and tools to debug, secure, and deploy the Outlook add-ins they create using Visual Studio 2005 Tools for Office.

Introducing Outlook Add-in Support in Visual Studio 2005 Tools for Office
Outlook add-in support simplifies interaction with the host application and provides a cleaner event framework for creating add-ins along with streamlined security.

Architecture of the Outlook Add-in Support in Visual Studio 2005 Tools for Office
Developers now have a robust, supported way to build managed add-ins for Office that use AppDomain isolation, a type-safe code model, and a strict code access security model.

Visual Studio 2005 Tools for Office - Developer Portal
Check here for the latest articles, code samples, snippets, trainings, and more for Visual Studio 2005 Tools for Office. New content published often!


Also

Don't Miss...

Outlook Add-in Hands-on Labs (Beta)Six new labs designed to help you create and work with Outlook 2003 add-in projects.

Outlook Add-in Samples (Beta)Five sample projects illustrating features and scenarios for developing Outlook 2003 add-in projects.

Outlook Add-in Snippets (Beta)Microsoft IntelliSense code snippets designed to assist developers with frequently occurring Outlook development tasks.

Get Visual Studio 2005 Beta 2Get the new Visual Studio 2005 Beta 2 release, which includes the latest tools for building Windows, Web, and mobile applications.

Resources:
Office Developer Center (http://msdn.microsoft.com/office)
TechEd 2005 USA
John R. Durant's WebLog (http://weblogs.asp.net/johnrdurant/rss.aspx)

Reading and Writing XML in .NET Version 2.0 - Part I

Read this article about XML and .Net 2.0. If you have never used the XML handling classes in 1.x, now is the best time. The XML classes has never been easier to use and there so much less code to write. The article makes it so easy to understand this XML classes. Read on...

Cheers
Sarbjit Gill

Technical Articles for BizTalk 2004

Greetings,

The following are some technical articles for BizTalk 2004. Some are relatively new and some updates. For example if you thinking on how to prioritize messages going into processing by an orchestration, then you should look at the BizTalk Server 2004 Convoy Deep Dive.

Anyway, here are the articles and the links

BizTalk Accelerator for HL7 Management Pack Guide. This document describes how to deploy and configure the sample HL7 Management Pack (MOM Pack). It also describes the integration of Microsoft BizTalk Accelerator for HL7 (BTAHL7) 1.0 Windows Performance Counters and Windows Management Instrumentation (WMI) events with Microsoft Operations Manager 2005 (MOM).

BizTalk Server 2004 Convoy Deep Dive. This paper discusses examples of business scenarios that require convoy message processing, explains convoy theory and messaging, and reviews each included sample.

BizTalk Server 2004 Deployment Guide for Security. This document provides guidelines to help you assess the potential threats to your BizTalk Server implementation, a sample architecture for small and medium-size companies, and a sample Point of Sale solution.

BizTalk Server 2004 Performance Characteristics. This document provides information about the performance characteristics of key BizTalk Server 2004 configurations and components, such as messaging, pipeline, and orchestration.

BizTalk Server 2004 Technical Guide for High Availability. This document contains information to help you understand, plan, and implement a highly available BizTalk Server 2004 environment.

Build Better Business Processes with Web Services in BizTalk Server 2004. This article focuses on one Web services specification that is critical, yet has been largely overlooked: the Business Process Execution Language for Web Services (BPEL4WS, or BPEL).

Connecting to the Elemica Network with BizTalk Accelerator for RosettaNet 3.0. This document describes how to enable Microsoft BizTalk Accelerator for RosettaNet (BTARN) 3.0 to connect to the Elemica Exchange Server Provider (ESP).

Developing Integration Solutions with BizTalk Server 2004. This document provides developers with techniques for designing, developing, and deploying solutions within BizTalk Server 2004.

Risk Scoring with BizTalk Server 2004 and the Business Rules Framework. This document presents an example BizTalk solution in which an insurance company uses the Business Rules Framework to create a risk profile for qualifying applicants.

Understanding BizTalk Server 2004. BizTalk Server 2004, an integration server, lets you to develop, deploy, and manage integrated business processes and XML-based Web services. This version of BizTalk Server provides integration between messaging and orchestration, and enhanced security and support for industry standards.

Using XML Schemas in BizTalk Server 2004. This document covers the basic concepts needed to create XML schemas and explains how they are used in Microsoft BizTalk Server 2004.

/Sarbjit Gill

Try the Office Dev Labs and Learn!

Microsoft Office Professional Edition 2003 provides a rich set of tools and technologies that enables developers to efficiently implement robust business solutions.

In these MSDN hosted virtual labs, you will use Word, Excel and InfoPath 2003 with industry standard XML, .NET Framework technologies and the Visual Studio Tools for Office.

Cheers
Sarbjit Gill

Using SharePoint Portal Server to Index Your Custom Application

Greetings,

Although you can plumb the depths of SharePoint's search engine, creating custom protocol handlers and IFILTERs to handle your site's custom search needs, for most sites, you can follow a much simpler process to provide customized searches.

Read more: http://www.devx.com/dotnet/Article/27998

/Sarbjit Gill

64-Bit .NET Framework

Greetings

MSDN:The 64-bit version of the .NET Framework 2.0 enables the .NET Framework platform, tools and applications to run on 64-bit workstations and servers which provide increased performance and scalability by addressing more memory (16 TB vs. 4G), processing more data (64 vs. 32 bits) per clock cycle and performing faster numeric calculations

Overview
Leverage Existing .NET Framework Code
Leverage Existing .NET Framework Development Experience
Leverage Existing Windows Investments
Getting Started
Development Articles
Development Tools
Code Samples
Visual Studio 2005 Remote Debugging

/Sarbjit Gill

SQL Server 2005 White Papers

Greetings folks,

Weather you are an IT professional or a developer, Thank You for attending the workshop(s) for SQL Server 2005 Overview for DBAs and Developers at Avantus Training, Singapore.

For further expoloring the coolest functionalities of SQL 2005, you have access to the SQL Server 2005 White Papers . Get up to speed with the latest technical information on SQL Server 2005 by reading these white papers on TechNet and MSDN.

Cheers
Gill

Visual Studio Tools for Office, Version 2005

Applies to: Microsoft Visual Studio Tools for the Microsoft Office System, Version 2005

Summary: Expert developers blog about their personal experience of designing, implementing, and deploying Visual Studio Tools for Office solutions for Word and Excel. Check out some of the best articles we found. (http://msdn.microsoft.com/office/default.aspx?pull=/library/en-us/odc_vsto2005_ta/html/OfficeVSTOBestOfBlogs2005.asp)

Web Part Development Resources To Get You Started.

Greetings,

As mentioned in the Regional Sharepoint TTT in Singapore recently, here is the resources/links i promised to post. Also note topics with regards to administration/managment(non-developer stuff) of a SharePoint POrtal Server or Windows Sharepoint Services, see my IT Pro blog, http://gill-itpro.blogspot.com. I would have something by Tuesday.

Anyway here it is:

Building Web Parts for Microsoft SharePoint Products and Technologies Part I - The Basics
This is the first of a 3 part series of Web Part development. This is during the beta days of SharePoint 2003. For an absolute beginner, this is a great start.

Building Web Parts for Microsoft SharePoint Products and Technologies Part II - Web Parts and User Controls
In this article, Patrick Tisseghem talks about using ASP.Net User Controls in the development process of Web Parts for SharePoint. There was a lot of excitement about using ASP.Net user controls in Web Part development. Here is another write up on using generic ASP.Net user controls in Web Parts.http://www.reflectionit.nl/WebPart1.aspx. This is written by Fons Sonnemans, a .Net and Sharepoint expert, to name a few. Of course at a later stage, the SmartPart was developed by Fons Sonnermans and Jan Tielens, which made using User Controls in WebParts very simple and straight forward. More information on SmartPart below under Additional Resources.

Building Web Parts for Microsoft SharePoint Products and Technologies Part III - Connectable Web Parts
In the third part, we are shown the basics of connectable webparts.

Here you will find Patrick Tisseghem's Blog, the author of the three parts above. He is a true expert of Sharepoint development. I will give you a list of blogs most useful for SharePoint Development.

Additional Resources.

1. MSDN's "A Developer's Introduction to Web Parts". This is much more complex then the 3 parts above, but still, this is from MSDN
2. Here is another: "Using Wppackager to Package and Deploy Web Parts for Microsoft SharePoint Products and Technologies". This is a packaging and deployment tool from Microsoft.
3. SmartPart: Firstly, Jan Tielens has written an introduction and even created a video demonstrating it in action. At the GotDotNet Workspace, you can download an installation package that will install the SmartPart, the source code and an example user control. These guys are coming up with some cool idea and SmartPart is going to get better in it's new releases. In the recent Office DevCon in Redmond, SmartPart was discussed :).
   Folks like Jan Tielens and Maxim Karpov, have extended the functionality of SmartPart. To get you started, here is Introducing "SmartPart for SharePoint"
   
   Here is some write-up about the latest version of SmartPart Ver. 1.0.0.0 from Jan's blog.
   
   An important aspect of using SmartPart of as a matter of fact any webpart and ASP.Net development is Code Access Security. CAS really comes into play because in most scenario’s your code won’t have Full Trust. At SharePoint, Code Access Security and the SmartPart, you would find very valuable information on Code Access Security with regards to Sharepoint/Asp.Net/WebPart/SmartPart.
   
   Since Maxim Karpov added the CAS policy support in the latest version of SmartPart, read Maxim's CAS articles:
   Code Access Security (CAS) and Design Patterns.
   SmartPart 1.0.0.0 Architecture and Code Access Security (CAS) .
   
   There is also something on MSDN on CAS and Windows Sharepoint Services
   Microsoft Windows SharePoint Services and Code Access Security
   
4. Microsoft SharePoint Products and Technologies 2003 Software Development Kit
   You would need this to go right down to technical details on web part development. Like Mr. Sivakumar (in the SharePoint TTT class) mentioned, come real good info is available on Code Access Security and Custom Control Security policies in the SDK. Note both Microsoft SharePoint Products and Technologies 2003 SDK and Microsoft Windows SharePoint Services SDK is available. This includes the latest updates from Jan 2005.
   
5. Next, is the Microsoft SharePoint Products and TechnologiesWeb Component Directory (Web Parts, Templates, Tools, and Complete Solutions). The Directory was designed to provide a place where thousands of developers and users who use Microsoft Windows® SharePoint Services and Microsoft Office SharePoint Portal Server 2003 can download and submit custom extensions.
   
6. Sharepoint top blogs
   http://weblogs.asp.net/soever/
   http://ipattern.com/simpleblog/
   http://weblogs.asp.net/jan
   http://blog.u2u.info/DottextWeb/patrick/
   http://www.reflectionit.nl/DotNetLog.aspx
   http://www.sharepointblogs.com/
   http://randomelements.me.uk/blog/default.aspx
   

That is all for now. Again, it was great having you guys and gals in the Sharepoint TTT class in Singapore from the 31st Jan 2005 to 4th Feb 2005. Have a great week ahead.

/Sarbjit Singh Gill

Did you know about the Elevated Privileges Application Launcher

Greetings,

Problem: You have an application that needs the user using the application to have administrative rights to execute successfully. But due to security policies, you don't want to give users admin rights. You want users to use the apps normal or power use only.

Solution: Look at, Elevated Privileges Application Launcher .

It should allow you to run your applications as a member of the Administrators without explicitly granting the end user the same privileges.

/Gill

Biztalk Server 2004 Information: New to Biztalk?

Greetings

If you are new to Microsoft Biztalk Server, start by watching a 15 minutes demo of the product.
http://www.microsoft.com/biztalk/evaluation/demo

Next, a great whitepaper giving you high-level technical overview of Biztalk 2004 and related technologies and all Biztalk 2004 features.
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/bts2004is/htm/understanding_abstract_syfs.asp

Next, would be MSDN Webcasts:
http://www.microsoft.com/biztalk/evaluation/introduction.asp. Following is a quick list of webcasts available. They are all pre-recorded webcasts.

Getting up to Speed with BizTalk Server 2004
Architecture
Orchestration
Business Rules
Integrating with SharePoint™
Using Web Services with BizTalk Server 2004
Advanced Orchestration Concepts in BizTalk Server 2004
Building on BizTalk Server 2004 Human Workflow Services for the Visual Studio .NET Developer
BizTalk Server 2004 Adapters for the Visual Studio .NET Developer
InfoPath Service Pack 1 and BizTalk Server
Adding Business Activity Monitoring Your BizTalk Server 2004 Projects
Real-World BizTalk Server 2004 Editing and Mapping Techniques
Performance and Early Adopter Experiences
Extending Mainframe Applications using BizTalk Server 2004 and Host Integration 2004
Migrating from BizTalk Server 2002 to 2004

Next, information on the Business Process Execution Language for Web Services (BPEL4WS)
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnbizspec/html/bpel4wsspecindex.asp
Learn more about this emerging OASIS standard for cross-company, cross-product business process automation and execution using web services that Biztalk Server 2004 supports.


Cheers
Gill

Biztalk Server 2004 Information: Product Downloads

Greetings,

As promised to the trainees at Avantus Training in my recent Biztalk 2004 training, here is the information about Microsoft Biztalk 2004 that i have collected so far. I will be posting regularly until i get all the content i have, out.

1. Biztalk Server 2004 Public Website
http://www.microsoft.com/biztalk/downloads/versions/default_2004.asp. Here you would find, BizTalk Server 2004 Trial Software, BizTalk Server 2004 Rollup Package 1, Orchestration Designer for Business Analysts, Management Pack for MOM, Product Documentation Update, Tutorials, User Guide for Information Workers, SDK Refresh. New stuff maybe added but this is what i see as of 21, Jan 2005.

Note that if you are a MSDN Universal subscriber, you could download the Developer edition of Biztalk 2004. BizTalk Server 2004 Developer Edition is limited solely to designing, developing, and testing purposes. You may not use it as a passive failover server or for disaster recovery.

Cheers
Gill

Web Services (ASMX) in Framework 2.0

Greetings,

I read this great articles at TheServerSide.net by author Christian Weyer. He is a MVP and Microsoft Regional Director. He has a blog at http://weblogs.asp.net/cweyer/

He starts off by writing an intro on web services in Framework 1.0 and 1.1. What was not good enough and what were developers looking to have, which even the service packs did not provide.

He goes on to the next parts showing you the amount of re-work Microsoft has done on Web Services 2.0 (hence the title of the articles, Web Services Strikes Back !).

Here are the urls:

http://www.theserverside.net/blogs/showblog.tss?id=WSStrikesBack (Intro)
http://www.theserverside.net/blogs/showblog.tss?id=WSStrikesBackP2
http://www.theserverside.net/blogs/showblog.tss?id=WSStrikesBackP3
http://www.theserverside.net/blogs/showblog.tss?id=WSStrikesBackP4


Happy reading.

/Gill

Second-order Code Injection Attacks

Abstract:
"Many forms of code injection targeted at web-based applications (for instance cross-site scripting and SQL injection) rely upon the instantaneous execution of the embedded code to carry out the attack (e.g. stealing a user's current session information or executing a modified SQL query). In some cases it may be possible for an attacker to inject their malicious code into a data storage area that may be executed at a later date or time.

Depending upon the nature of the application and the way the malicious data is stored or rendered, the attacker may be able to conduct a second-order code injection attack.
A second-order code injection attack can be classified as the process in which malicious code is injected into a web-based application and not immediately executed, but instead is stored by the application (e.g. temporarily cached, logged, stored in a database) and then later retrieved, rendered and executed by the victim."

The paper is available from:
http://www.nextgenss.com/papers/SecondOrderCodeInjection.pdf

Monitoring blocking on a Microsoft SQL 2000

Quite often, due to a bad application design, SQL Server connection/process blocking becomes a major issue with application performance and in worse-case scenarios, the break-point of the applications.

Developers may be good at programming code writing but they are not experts at writing T-SQL. A true DBA would know the exact T-SQL syntax which would bring out the best of performance.

The main point of this blog entry is to let developers know that there is published techniques in obtaining detailed instrumentation of blocking activities on a SQL Server

The original articles was published for SQL 7.0.

This articles document the usage and design of a stored procedure that you can use to diagnose blocking and performance issues.

251004 How to monitor SQL Server 7.0 blocking
224453 Understanding and resolving SQL Server 7.0 blocking problem


The articles has now been updates for SQL 2000 and the latest is here:
How to monitor SQL Server 2000 blocking.

Cheers
Gill

What is this blog is for.

Greetings,

As a Microsoft Certified Trainer, I provide training and pre-sales services to Microsoft Learning Partners. Occasionally I get to present at TechNet and MSDN events for Microsoft Singapore. There are times where I am on-site for trouble shooting, development, design or merely working on a tender.

Anyway back to the point of me starting this blog, I get asked a lot of questions during and after courses with regards to .Net development for the Microsoft Official Curriculum courses that I conduct. So this blog is for those questions. Also from time to time, I will be writing my experiences as I learn/explore new technologies with regards to Microsoft Technologies as part of my preparation for training and projects.

/Gill