ASP security

 Defense in Depth
Never rely on a single point of defense. Your application is often the last layer between an attacker
and back  -end systems such as a database or a fi le server, which, in turn, may be connected to a
corporate network. If your application is hacked, then these systems may be exposed to the attacker.
By using several layers of defensive techniques in your application such as input validation, secure
SQL construction, and proper authentication and authorization, your application will be more
resilient against attack.
  Never Trust Input
As you discovered in the example attack earlier in this chapter, a simple change to an input into the
application may result in a security breach. Input is everything that comes into your application
during run  -time — user data entry, the click of a button, data loaded from a database or remote
system, XML fi  les, anything you cannot know about at the time your application is compiled.
Every single piece of input should be validated and proved correct before you process it. If invalid
input is sent to your application, then your application must cope with it correctly, and not crash or
otherwise act upon it.

Цааш нь унших

Security tip

There are two types of PC safety, and you need to ensure that your PC is well versed in both of them. The first involves hardware or system errors, which can lead to the loss of impor tant data. Over
the page, we've compiled 50 of the best tips to prevent your PC and Windows XP from going belly-up, as well as some safeguards and recovery plans in case the worst does happen. You'll learn, among other things, how to restore your entire system to a previous, stable state, how to update Windows XP
with any new software that improves its safety features, how to deal with common hardware problems, how to prevent your PC from overheating, how to clean up your hard disk to improve speed and reliability, and even how to back up your entire system so you can recover everything in the event of disaster. If all that sounds complicated, don't worry – simply by being familiar with a few major safeguards, you should easily be able to deal with most PC catastrophes. Then there's the other type of PC safety, which is all about protecting your system from malicious outside influence. There are
folk out there determined to hack into other people's PCs and steal or destroy data, not to mention the thousands of viruses released purely to cause havoc. In this section, you'll find our 18 most crucial tips
for safeguarding yourself against this sort of enemy incursion, enabling you to get your PC locked up tighter than For t Knox.

Цааш нь унших

Education is important in Security

Traditionally, security folks have attempted to obscure security information from the average user. As such, security specialists occupy positions of prestige in the computing world. They are regarded as high priests of arcane and recondite knowledge that is unavailable to normal folks. There was a time when this approach had merit. After all, users should be afforded such information only on a need-to-know basis. However, the average American has now achieved need-to-know status. So, I pose the question again: Who needs to be educated about Internet security? The answer is: We all do. I hope that this book, which is both a cracker's manual and an Internet security reference, will force into the foreground issues that need to be discussed. Moreover, I wrote this book to increase awareness of security among the general public. As such, this book starts with basic information and progresses with increasing complexity. For the absolute novice, this book is best read cover to cover. Equally, those readers familiar with security will want to quickly venture into later chapters. The answer to the question regarding the importance of education and Internet security depends on your station in life. If you are a merchant or business person, the answer is straightforward: In order to conduct commerce on the Net, you must be assured of some reasonable level of data security. This reason is also shared by consumers. If crackers are capable of capturing Net traffic containing sensitive financial data, why buy over the Internet? And of course, between the consumer and the merchant stands yet another class
of individual concerned with data security: the software vendor who supplies the tools to facilitate that commerce. These parties (and their reasons for security) are obvious. However, there are some not so obvious reasons.

Privacy is one such concern. The Internet represents the first real evidence that an Orwellian society can be established. Every user should be aware that nonencrypted communication across the Internet is totally insecure. Likewise, each user should be aware that government agencies--not crackers--pose the greatest threat. Although the Internet is a wonderful resource for research or recreation, it is not your friend (at least, not if you have anything to hide).

Цааш нь унших

Web security matters

Imagine working for the company providing Microsoft UK’s events registration system. It  ’s the beginning of summer in June 2007, and the news is fi  lled with fl  oods in the north of England where people have had to evacuate their homes while the rest of the country swelters in the well  -above  -average heat and sunshine. You fi  re up your Web browser just to check how your site is doing. You’ve been hacked!

It does so by illustrating the problem and showing you how bad code can be used to attack an unprotected Web site. I fi rmly believe this is the best way to illustrate the problem and drive home the fact that Web security is something every Web developer should keep in mind as he or she develops a new site. It may be tempting to try out some of the techniques shown on a friend ’  s Web site, or your
company’s Web site, or even a Web site that you visit on a regular basis. I have a single word of advice about this   —      don’t  !  Hacking is illegal in the majority of countries, regardless of the intent behind it, and using any of the exploits described in this book may land you in serious trouble. Neither the author nor Wrox condone or defend anyone who attacks systems they do not own, or have not been asked to attack by the owner. a typical layout of the hardware involved in a Web site: the client (or attacker), a firewall, the Web server, and perhaps a separate SQL server and file server to store uploaded documents. In the early days of Web security, most hacks made use of vulnerabilities in the Web server software, the operating system hosting it, or the ancillary services running on it
(such as FTP or email)

Цааш нь унших