Improving Web Application Security: Threats and Countermeasures

To build secure Web pages and controls, you need to follow the correct programming practices that this chapter discusses. In addition to secure programming practices, use the corresponding chapters in this guide to help you build secure ASP.NET pages and controls.

• Implement the steps in Chapter 19, "Securing Your ASP.NET Application and Web Services." The chapter helps you configure ASP.NET appropriately with secure settings in Machine.config and Web.config.

• Use the accompanying checklist in the checklist section of this guide . "Checklist: Securing ASP.NET" ties the recommendations made in this chapter and in Chapter 19 together. Make sure you implement the guidance.

• Understand the threats and attacks that are specific to ASP.NET pages and controls . Apply countermeasures according to guidelines in this chapter.

• Read Chapter 4, "Design Guidelines for Secure Web Applications." Many of the recommendations in this chapter (Chapter 10) are based on the design guidelines discussed in Chapter 4.

• Architects should use the "Design Considerations" section of this chapter .

• Developers should apply the guidance in this chapter to their development process .

• Learn the controls from a programmatic standpoint to fine-tune ASP.NET pages and controls security .

• Use the application vulnerability categories as a means to tackle common problems . Application vulnerability categories provide a useful way to approach and group problems.