Developer .NET UPDATE--Spring Training--March 5, 2004

This Issue Sponsored By

LearnKey, Inc.

http://www.learnkey.com/sqldev

DevConnections: Win a Harley Motorcycle

http://www.devconnections.com

In This Issue

Developer .NET Perspectives

http://www.learnkey.com/sqldev

Developer .NET Perspectives

by Bill Sheldon, [email protected]

http://msdn.microsoft.com/events/devdays

Because not everyone who receives Developer .NET UPDATE is near a participating city or can take the time to attend this Microsoft event, I want to let you know what DevDays 2004 covers and tell you about some informative materials that are currently available.

The good news is that DevDays doesn't concentrate on what's coming or what's new in developer tools. Instead, after you get past the opening keynote, you're immersed in best practices for working with existing tools, such as Visual Studio .NET 2003.

In the Web Development Track, the presentation starts with an introduction to security threats, such as the cross-site scripting attack or the far more dangerous SQL Injection attack. In case you've never heard of these commonly used attacks, let's take a quick look at them. The cross-site scripting attack targets input that your site reposts to the user's display. To execute this attack, an intruder attempts to input script tags through your input fields, which are then included in text displayed on your site. The result is that the embedded tags redirect other users and their subsequent input to the intruder's site. The rogue script tags, which become embedded in your site, pose a risk to your site's visitors. In an SQL Injection attack, an intruder submits commands against your site's database. The SQL Injection attack relies on two coding practices that you should avoid: not validating user input before using it and using dynamic SQL statements.

You can easily defend against the cross-site scripting attack and the SQL Injection attack. At the end of this column, I include links to sites where you can get more information about defending against the SQL Injection attack. However, at DevDays, Microsoft presented a more elegant way to defend against this attack.

As part of DevDays, and in particular in the session I present, participants review the source code for Microsoft's OpenHack reference application. Microsoft created this application for eWeek's OpenHack 4 competition, which was held to test Web application security. For this competition, eWeek asked participants to harden a provided Web application and deploy the hardened application on their choice of OS, Web server, application server, and database platforms. Both Microsoft and Oracle submitted hardened applications and servers, which were posted online. Then eWeek issued a challenge to hackers to try to complete any of five hacking challenges on the posted systems. In the competition, Microsoft's hardened application withstood more than 80,000 attacks.

What makes Microsoft's OpenHack reference application really interesting is that Microsoft built this application to meet a third party's requirements. The application wasn't based on what someone in Redmond wanted marketed that week, nor does it highlight the latest technical feature. For example, the application doesn't rely on Active Directory (AD) for authentication but instead uses Forms-based authentication and keeps its users in Microsoft SQL Server. The application operates as a true Internet application.

The point of the DevDays session is to show that by addressing input validation issues, you can use ASP.NET to create a secure Internet application. Fortunately, you don't have to attend DevDays to get this information. Although I can't give you a link to the source code for the OpenHack reference application, Microsoft has a comprehensive review of how to secure ASP.NET applications in the guide "Improving Web Application Security: Threats and Countermeasures." You can download this free guide from the following Web site:

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/threatcounter.asp

The Smart Client Track provides practical information about how to leverage the power of the desktop. As XML Web Services continue to evolve, you can create a distributed application that isn't bound to the browser's limitations. To this end, DevDays has a series of presentations that culminate in the creation of a trickle-down smart client. The concept behind trickle-down smart clients is that you can post your client application to a local URL and have users download and run the application locally. The result is that you leverage the power of the client without having the costs associated with physically touching each client to install applications or perform machine maintenance.

Although the opening and closing keynote speakers discuss the future of Microsoft tools, the tracks in this year's DevDays concentrate on what you can do with the tools you have today. In the March 19 issue, I'll continue that theme by discussing how to use SQL Server 2000 Windows CE Edition (SQL Server CE), a poorly documented but powerful tool for mobile applications. In the meantime, here are some links to information about the topics covered in DevDays:

Literally hundreds of Webcasts exist that can provide you relevant information about all kinds of topics, including development, security, Microsoft .NET and Web services, and SQL Server. The good news is that Windows & .NET Magazine recently added an events section to its Web site that indexes many of these events. To access this site, which is devoted to both on-demand and upcoming live events, go to:

http://www.winnetmag.com/events

Sponsor: DevConnections: Win a Harley Motorcycle

DevConnections conference and expo will be held April 18 - 21. Back by popular demand are concurrently running events Microsoft ASP.NET Connections, Visual Studio Connections, and SQL Server Magazine Connections. Details about workshops, sessions, and speakers are online, including the exclusive Microsoft Day on "Yukon" and "Whidbey". Save $200, receive access to all three conferences for one price, and get a chance to win a Harley motorcycle. Go online or call 800-438-6720 or 203-268-3204.

http://www.devconnections.com

Announcements
(brought to you by SQL Server Magazine)

http://www.sqljunkies.com

http://secure.pentontech.com/nt/sql/index.cfm?PromoCode=psep2143fd

Events Central
(A complete Web and live events directory brought to you by Windows & .NET Magazine: http://www.winnetmag.com/events )

http://www.winnetmag.com/seminars/sqlreportingservices/index.cfm?code=devupdate

New and Improved
by Shauna Rumbaugh, [email protected]

http://www.emeditor.com

Sponsored Links

Quest Software, Inc.

Database Contention Affecting SQL Server Performance? Download White Paper.

http://www.quest.com/landing/sqlmag_link1.asp

DB Ghost for SQL Server

Take control of your source code! Change mgt for SQL is here.

http://www.dbghost.com

Contact Us

http://www.winnetmag.com/sub.cfm?code=wswi201x1z

View the Windows & .NET Magazine Privacy policy at

http://www.winnetmag.com/aboutus/index.cfm?action=privacy

Windows & .NET Magazine a division of Penton Media, Inc.
221 East 29th Street, Loveland, CO 80538
Attention: Customer Service Department

Copyright 2004, Penton Media, Inc. All Rights Reserved.