Related Articles
Surprisingly, cryptography can be applied to the electoral process to allow every individual voter to check the integrity of an election tally. Find out how here. Josh Benaloh MSDN Magazine June 2008 ... Read more!
Here we introduce Microsoft Code Name “Geneva,” the new framework for building claims-based applications and services, and federated security scenarios. Michele Leroux Bustamante MSDN Magazine December 2008 ... Read more!
Using threat models to drive your security engineering process helps prioritize the code review, fuzz testing, and attack surface analysis tasks. Michael Howard MSDN Magazine November 2008 ... Read more!
Here's an overview of the new System.DirectoryServices.AccountManagement class in the .NET Framework 3.5 and how it simplifies working with directory services. Joe Kaplan and Ethan Wilansky MSDN Magazine January 2008 ... Read more!
In this installment we introduce you to new Web-oriented security guidance and tools straight from the Security Development Lifecycle (SDL) team at Microsoft. Bryan Sullivan MSDN Magazine September 2008 ... Read more!
Also by this Author
Editor-in-Chief Howard Dierking explains why it's wise to consider Microsoft Office a development platform, even though developers typically don't. Howard Dierking MSDN Magazine May 2008 ... Read more!
This month Howard Dierking reflects on 2007 and looks forward to exciting possibilities in 2008. Howard Dierking MSDN Magazine December 2007 ... Read more!
This month Howard Dierking cautions against designing applications in a vacuum with no connection to reality. Howard Dierking MSDN Magazine March 2008 ... Read more!
Introducing the issue, Howard Dierking points out that you can't simply parallelize your code blindly if you expect to truly reap the benefits that parallelism promises. Howard Dierking MSDN Magazine October 2008 ... Read more!
Howard Dierking talks to the inventor of C++, Bjarne Stroustrup, about language zealots, the evolution of programming, and what’s in the future of programming. Howard Dierking MSDN Magazine April 2008 ... Read more!
Popular Articles
Ray Djajadinata MSDN Magazine May 2007 ... Read more!
Chris Tavares explains how the ASP.NET MVC Framework's Model View Controller pattern helps you build flexible, easily tested Web applications. Chris Tavares MSDN Magazine March 2008 ... Read more!
Jeff Prosise explains when it's better to use UpdatePanel and when it's better to use asynchronous calls to WebMethods or page methods instead. Jeff Prosise MSDN Magazine June 2007 ... Read more!
The MVP pattern helps you separate your logic and keep your UI layer free of clutter. This month learn how. Jean-Paul Boodhoo MSDN Magazine August 2006 ... Read more!
When incorporating the ASP.NET DataGrid control into your Web apps, common operations such as paging, sorting, editing, and deleting data require more effort than you might like to expend. But all that is about to change. The GridView control--the successor to the DataGrid-- extends the DataGrid's functionality it in a number of ways. First, it fully supports data source components and can automatically handle data operations, such as paging, sorting, and editing, as long as its bound data source object supports these capabilities. In addition, ...
Read more!
Our Blog
C# developers can use the Visual Studio Tools for the Office System (VSTO) Power Tools Office interop API extensions to streamline Office application development. The extensions provide a thin, strongly typed layer over the loosely typed Office object models. In the December 2008 issue of MSDN Magazine, Andrew Whitechapel, Phillip Hoff, and Vladimir Morozov walk you through developing ...
Read more!
Earlier this year MSDN Magazine embarked on a collaborative project with Behind the Code, an interview program airing on MSDN Channel 9. In this program, Robert Hess interviews prominent developers at Microsoft, and those developers also write a column for { End Bracket } in MSDN Magazine. In the newest interview, Richard Ward talks about working on the core infrastructure components of future versions of Windows, as well as ...
Read more!
A team project is simply a bucket that stores and partitions all of the artifacts you track and use within a Team Foundation Server (TFS) project. In the December 2008 issue of MSDN Magazine, Brian A. Randell explains how you can use and customize the MSF Agile and MFS CMMI process templates to get the most out of them for your ...
Read more!
We're currently in the process of stepping back and taking a critical look at our Web site to see how you all are using it - and how we can redesign parts of it (big or small) to make that experience better. We are continuously receiving your feedback on existing frustrations and we are working hard to remedy those (as a general fyi, most of the frustrations have to do with navigation). However, in order to get a sense of whether we need to look at some of the more fundamental ...
Read more!
With the releases of LINQ to SQL and the ADO.NET Entity Framework, developers now have two products from Microsoft designed to tie together relational data and object-oriented programming. In the December 2008 issue of MSDN Magazine, Anthony Sneed provides a roadmap to these technologies and demonstrates how you can create ...
Read more!
|
Editor's Note
Why Go to Extremes?
Howard Dierking
"Is your system secure?" This question, along with its cousin, "How secure is your system?," seems to be one of the funnier questions we are typically asked by business and IT stakeholders alike. The question is funny, not because security isn't important—to the contrary, in this day and age, security has never been more important—but because it is too general to have any measurable meaning.
In both variants, the most concrete answer you could ever really give is: "more secure than some, less secure than others." Of course, this answer is not very satisfying to a business, and as such, it is never given. Instead, we often end up defining security in terms of rather extreme absolutes. In one extreme, we focus solely on the business requirements of the system, relying on the IT department to supply a checklist of security-related tasks that we implement before deploying the system. In the other extreme, we spend countless amounts of time and energy researching and securing against every possible exploit that has ever been attempted in the history of the software industry—far surpassing the most stringent of DoD standards—and many times subjugating the needs of the business to the needs of our paranoia.
For this year's security issue of MSDN Magazine, I'm very happy to see an emphasis placed on a pragmatic approach to creating an effective, measureable security strategy. Michael Howard leads off with a discussion of some practical best practices he has learned over the past five years in building secure software at Microsoft. Following Howard's discussion of best practices, Michal Chmielewski, Neill Clift, Sergiusz Fonrobert, and Tomasz Ostwald discuss techniques for integrating security-related activities—both automated and manual—more deeply into the existing development lifecycle. Dan Griffin extends this discussion with a more concrete example of automated integration by developing a fuzz testing add-in for Visual Studio Team System. Finally, for those of you who just don't feel complete as developers without looking at assembly language, Adel Abouchaev, Damian Hasse, Scott Lambert, and Greg Wroblewski dive deep—really deep—into the different conditions that can cause your applications to crash, and how each of those conditions may additionally create security vulnerabilities.
.gif)
One of the themes that seems to reoccur throughout many of this month's articles is that security concerns are constantly evolving and are based on a realistic assessment of threat—which is why the emphasis in this issue is more about creating a solid security strategy than it is on how to "do security" for an application. When you look at security in this light, security concerns look more like business requirements than static, infrastructure concerns—and perhaps if we can look at them this way, we can figure out how to create a reasoned, measurable security strategy, and thereby avoid going to one extreme or the other.
Speaking of measurable, one other quick note: we are constantly trying to improve the quality of both the content and the planning of MSDN Magazine. And, among other things, we rely on the ratings system found on the online version of each article in the issue. You can have a very direct impact on the magazine by simply going to the online version of an article you read here and rating it using the rating control. Your opinion matters.
Code safe! —Howard
Thanks to the following Microsoft technical experts for their help with this issue: Eric Bidstrup, Joe Binder, Todd Brooks, Claudio Caldato, John Durant, Steve Fox, Matt Gibbs, Ed Hintz, Michael Howard, Richard Johnson, Ivan Medvedev, Dave Reed, Bruce Taimana, Chris Tavares, Mads Torgersen, and James Whittaker.
|
|