Writing Secure Code

One of the key things that developers can do to help secure their systems is to write code that can withstand attack and use security features properly. This page contains links to best practices and how-to articles on writing secure code.

Getting Started

• How To: Secure Your Developer Workstation
  
• 10 Security Tips: Defend Your Code with Top Ten Security Tips Every Developer Must Know
  
• An Overview of Security in the .NET Framework
  
• Web Application Security Fundamentals
  
• Trustworthy Computing: Lessons Learned from Five Years of Building More Secure Software
  

Best Practices

• The Trustworthy Computing Security Development Lifecycle
• Improving Web Application Security: Threats and Countermeasures
• Security Guidance for Applications: Checklists, How Tos
• MSDN Magazine Articles on Security

Validating Input and Preventing Attacks

• All Articles, Tools, and How-Tos
• Stop SQL Injection Attacks Before They Stop You
• Writing Error Messages for Security Features
• How To: Prevent Cross-Site Scripting in ASP.NET
• How To: Protect From SQL Injection in ASP.NET

Authentication & Authorization

• Introduction to Role-Based Security for the .NET Framework version 1.1 , 2.0 , 3.0 and 3.5
• Security Model for ASP.NET Applications
• Building Secure ASP.NET Applications: Authentication, Authorization, and Secure Communication

Securing and Encrypting Sensitive Data

• Cryptography Simplified in Microsoft .NET
• Cryptography Overview for the .NET Framework version 1.1, 2.0, 3.0 and 3.5
• Encrypting and Decrypting Data with the .NET Framework version 1.1, 2.0, 3.0 and 3.5
• XML Encryption and Digital Signatures with the .NET Framework version 2.0, 3.0 and 3.5
• SQL Server 2005 Encryption How-to Topics

Security for C/C++ Code

• Security Development Lifecycle Banned Function Calls
  
• Using Application Verifier Within Your Software Development Lifecycle
  
• Windows Vista ISV Security
  

Privacy and Compliance

• TechNet Webcast: Assessing and Managing Privacy in the Enterprise
  
• MSDN TV: Using Administrative Templates to Deploy Privacy Settings
  
• MSDN TV: Privacy Awareness for Developers
  
• Regulatory Compliance Demystified: An Introduction to Compliance for Developers
  

.NET Framework Security

• Security in .NET Framework versions 1.1, 2.0, 3.0 and 3.5
• Extending .NET Cryptography with CAPICOM and P/Invoke
• HTTP Security and ASP.NET Web Services

Threat Modeling

• Threat Modeling Tool
  
• Book: Threat Modeling
  
• Resource File: Threat Model Your Security Risks
  

Web Services Security

• Build Secure Web Services with Web Services Enhancements 3.0
  
• Defending Your XML Web Service Against Attacks, Part I
  
• Defending Your XML Web Service Against Hackers, Part II