Chapter 2: .NET Framework Security Overview

Overview

• Finding .NET Security Information

• Using the System.Runtime.Remoting.Contexts Namespace

• Using the System.Security Namespace

• Using the System.Security.Cryptography Namespace

• Using the System.Security.Permissions Namespace

• Using the System.Security.Policy Namespace

• Using the System.Security.Principal Namespace

• Using the System.Web.Security Namespace

• Using the System.DirectoryServices Namespace

The .NET Framework provides a lot of security programming assistance in the form of namespaces and classes. Unlike the Win32 API, Microsoft has actually gathered these features together into a number of areas, making it easy to find what you need. The problem for many developers is learning which namespace to use and determining when to use it. Security is a large topic no matter how much help the underlying programming structure provides.

The first section of this chapter provides some pointers on where to locate security information you need. This section covers a number of topics that you need to know in order to build a strong development platform and assess risks for users of your finished program. Most of the locations are online because these sites generally update the information they provide as Microsoft introduces new features. Of course, some of your best sources of information are the examples in this book.

The remaining sections of the chapter introduce you to important namespaces that you’ll use regularly for .NET programming. I chose not to differentiate between distributed and local programming in this case, because most developers need an overall solution that works as well on the desktop as it does on the Web site. Each of the sections will have a short example, in addition to useful programming tips and application usage guidelines. The examples in this chapter are a little on the simple side—each of the namespaces is covered in depth as the book progresses. The important consideration is to gain an understanding of the namespaces and discover what they can do for you.

Note

Every one of the namespace sections contains an online source of information for that namespace. You might wonder why this is important given that you have perfectly usable help available on your hard drive. The security information that Microsoft provides is bound to change as the .NET Framework matures. In order to see the most current information about the namespaces, you need to get online and view the information there. The information found on your hard drive might be just enough out-of-date that you miss a cracker exploit (security vulnerability) that Microsoft has shown how to remedy through improved examples or documentation. Many other areas of the book will also include online resources so that you can create the most secure programs possible by using current information.