Never trust data, model threats against your code, and other good advice from a security expert. Michael Howard

Whenever you build a new system you should consider how an in¬truder might go about attacking it and then build in appropriate defenses at design time. Shawn Hernan, Scott Lambert, Tomasz Ostwald, Adam Shostack

Use Active Directory Federation Services to allow other organizations to use your Web applications without the need for you to grant access explicitly. Keith Brown

Smart cards are a compelling alternative to the reliance on passwords, which are the weakest link in authentication systems. Get the Windows smart card programming basics here. Dan Griffin

In this article, the author presents an extension to the Security Development Lifecycle Which could promote a better flow of information between users and designers of software security features. Mark Novak

Exploits using SQL injection have drawn a lot of attention for their ability to get through firewalls and intrusion detection systems to compromise your data layers. Whether it's a first-order or second-order injection, if you look at the basic code pattern, it is similar to any other injection issue where you use untrusted data in the construction of a statement. Bala Neerumalla