Organization of This Book

[Previous] [Next]

We loosely based the format of this book on a successful security paper we delivered at Tech-Ed, a Microsoft-sponsored event for corporate developers, in Dallas, Texas, in May 1999. It was the first public demonstration of a multitier Web-enabled application performing Kerberos delegation. This book is organized into four parts.

Introduction and Design

Chapter 1, "Security 101," outlines core security principles and a taxonomy of security categories and threats. Chapter 2, "A Process for Building Secure Web Applications," describes a process for designing secure applications and follows up with an example scenario used as the basis for much of the rest of the book. The security solution design process is applied to the example application so that you can see how the process works. Security experts can possibly skip Chapter 1; however, everyone should read Chapter 2 because it serves as the cornerstone for the rest of the book.

Technologies and Trade-Offs

Chapters 3 through 7 cover the security features and capabilities of Windows 2000, Microsoft Internet Explorer 5, Internet Information Services 5, SQL Server 7, SQL Server 2000, and COM+ 1.0. This is highly recommended reading. Even if you've been using these products for some time, we know you'll find some new material in these chapters. Each chapter covers the security capabilities of the product in detail, offering many insights into how the product works.

Chapters 8 and 9—"Practical Authentication and Authorization" and "Practical Privacy, Integrity, Auditing, and Nonrepudiation"—investigate the practical side of security technology. Rather than focusing on pure technology, these chapters look at trade-offs you can make when choosing different types of technology to satisfy the core security requirements described in Chapter 1. The trade-offs are considered in terms of functionality, scalability, and "deployability," as well as the security implications of the requirements you choose to satisfy and how you go about satisfying them.

In Practice

Chapter 10, "Building a Secure Solution," looks at how to build an application for the scenario defined in Chapter 2 by using the technologies and strategies discussed in Chapters 3 through 9. This is a critical chapter in the book because it covers one of the most common questions people have asked us over the years: how do you securely flow identity throughout a secure application? Chapter 11, "Troubleshooting Secure Solutions," explains one of the most important aspects of building any application—how to troubleshoot the architecture. We explain how to read event log entries, describe tools that can help you look for problems, and discuss some common errors, including what they mean and how to remedy them.

Chapter 12, "Securing Against Attack," focuses on what to expect when you put an application on the Web. It is based on experiences gained—some painful!—while building and deploying secure Web applications and placing them on the Internet. If you're going to the trouble of putting an application on the Web, do yourself a service by reading this chapter!

Reference

Chapter 13, "Security Administration with ADSI, WMI, and COM+," covers how to use the tools and scriptable interfaces in Windows 2000 to build custom, remotable administration scripts by using Microsoft JScript, Microsoft VBScript, and Perl. Finally, Chapters 14 and 15—"An Introduction to Kerberos Authentication in Windows 2000" and "An Introduction to Cryptography and Certificates in Windows 2000"—introduce the reader to Kerberos authentication and cryptography and certificates in Windows 2000. Both chapters are pragmatic and easy to follow.