Writing Secure Code

One of the key things that developers can do to help secure their systems is to write code that can withstand attack and use security features properly. This page contains links to best practices and how-to articles on writing secure code.

Getting Started

• The Security Development Lifecycle Process
  
• 10 Security Tips: Defend Your Code with Top Ten Security Tips Every Developer Must Know
  
• Lessons Learned from Five Years of Building More Secure Software
  
• Security Compliance as an Engineering Discipline
  
• An Overview of Security in the .NET Framework
  
• Web Application Security Fundamentals
  

Best Practices

• Simplified Implementation of the Microsoft Security Development Lifecycle (SDL)
• Improving Web Application Security: Threats and Countermeasures
• Security Guidance for Applications: Checklists, How Tos
• MSDN Magazine Articles on Security

Validating Input and Preventing Attacks

• All Articles, Tools, and How-Tos
• SDL Quick Security References: Cross-Site Scripting, SQL Injection, Exposure of Sensitive Information
• Stop SQL Injection Attacks Before They Stop You
• Writing Error Messages for Security Features
• How To: Prevent Cross-Site Scripting in ASP.NET
• How To: Protect From SQL Injection in ASP.NET

Authentication & Authorization

• Introduction to Role-Based Security for the .NET Framework version 1.1 , 2.0 , 3.0 and 3.5
• Security Model for ASP.NET Applications
• Building Secure ASP.NET Applications: Authentication, Authorization, and Secure Communication

Securing and Encrypting Sensitive Data

• Cryptographic Agility
• Cryptography Simplified in Microsoft .NET
• Cryptography Overview for the .NET Framework version 1.1, 2.0, 3.0 and 3.5
• Encrypting and Decrypting Data with the .NET Framework version 1.1, 2.0, 3.0 and 3.5
• XML Encryption and Digital Signatures with the .NET Framework version 2.0, 3.0 and 3.5
• SQL Server 2005 Encryption How-to Topics

Security for C/C++ Code

• Security Development Lifecycle Banned Function Calls
  
• Using Application Verifier within Your Software Development Lifecycle
  
• Windows Vista ISV Security
  

Privacy and Compliance

• Privacy in Software Development
  
• Privacy Guidelines for Developing Software Products and Services
  
• MSDN TV: Using Administrative Templates to Deploy Privacy Settings
  
• MSDN TV: Privacy Awareness for Developers
  
• Regulatory Compliance Demystified: An Introduction to Compliance for Developers
  
• SDL and HIPAA – Aligning Microsoft SDL Security Practices with the HIPAA Security Rule
  
• SDL and PCI DSS/PA-DSS – Aligning the Microsoft SDL with PCI DSS / PA-DSS Compliance Activity
  

.NET Framework Security

• Security in .NET Framework versions 1.1, 2.0, 3.0 and 3.5
• Extending .NET Cryptography with CAPICOM and P/Invoke
• HTTP Security and ASP.NET Web Services

Threat Modeling

• SDL Threat Modeling Tool
  
• Uncover Security Design Flaws Using the STRIDE Approach
  
• Reinvigorate Your Threat Modeling Process
  
• Threat Models Improve Your Security Process
  
• Getting Started with the SDL Threat Modeling Tool
  
• A Conversation about Threat Modeling
  
• Introduction to Microsoft SDL Threat Modeling
  
• Book: Threat Modeling
  
• Resource File: Threat Model Your Security Risks
  

Web Services Security

• Build Secure Web Services with Web Services Enhancements 3.0
  
• Defending Your XML Web Service Against Attacks, Part I
  
• Defending Your XML Web Service Against Hackers, Part II