Overview

Assemblies are the building blocks of .NET Framework applications and are the unit of deployment, version control, and reuse. They are also the unit of trust for code access security (all the code in an assembly is equally trusted). This chapter shows you how to improve the security design and implementation of your assemblies. This includes evaluating deployment considerations, following solid object-oriented programming practices, tamperproofing your code, ensuring that internal system level information is not revealed to the caller, and restricting who can call your code.

Managed code, the .NET Framework, and the common language runtime eliminate several important security related vulnerabilities often found in unmanaged code. Type safe verification of code is a good example where the .NET Framework helps. This makes it virtually impossible for buffer overflows to occur in managed code, which all but eliminates the threat of stack-based code injection. However, if you call unmanaged code, buffer overflows can still occur. In addition, you must also consider many other issues when you write managed code.