Designing Secure Web-Based Applications for Microsoft Windows 2000 with CDROM

ISBN: N/A
EAN: N/A

Year: 1999
Pages: 138

BUY ON AMAZON

Cover
LOC Page
Dedication
Foreword
Preface
Who Should Read This Book?
Organization of This Book
About the Companion CD
System Requirements
Acknowledgments
Part I: Introduction and Design
Chapter 1 -- Security 101
Security Defined
Why Is Security Difficult?
The Golden Rules (and Some Others)
Threats, Safeguards, Vulnerabilities, and Attacks
Summary
Chapter 2 -- A Process for Building Secure Web Applications
A Security Design Process
Application Design
An Example
Part II: Technologies and Trade-Offs
Chapter 3 -- Windows 2000 Security Overview
The Impact of Active Directory
Authenticated Logon
Authentication
Privileges
User Accounts and Groups
Domains and Workgroups
DOMAINAccount Names and User Principal Names
Managing Accounts
Security Identifiers (SIDs)
Tokens
Access Control Lists
Impersonation
Delegation
Miscellaneous Windows 2000 Security Features
Summary
Chapter 4 -- Internet Explorer Security Overview
Privacy
Code Safety and Malicious Content
Security Zones
SSLTLS and Certificates
Cookie Security
Chapter 5 -- Internet Information Services Security Overview
Internet Authentication
Configuring SSLTLS
IIS Authorization -- the Marriage of Windows 2000 Security and the Web
IIS Process Identities
Summary
Chapter 6 -- SQL Server Security Overview
Security Modes
Logins, Users, and Permissions
Network Security Options
SQL Server Logins
SQL Server Database Users
SQL Server Database Roles
SQL Server Permissions
Summary
Chapter 7 -- COM Security Overview
Architecture
COM Authentication
COM Authorization
Debugging Tips
Using DCOM over the Internet
Chapter 8 -- Practical Authentication and Authorization
Where to Perform Authentication and Authorization
Application vs. Operating System Identity Flow
Relative IIS Authentication Performance
Example Authentication and Authorization Scenarios
A Warning About Custom Authentication and Passwords
Summary
Chapter 9 -- Practical Privacy, Integrity, Auditing, and Nonrepudiation
Privacy and Integrity Overview
Where Privacy and Integrity Issues Occur
Mitigating Privacy and Integrity Threats
Auditing
An Introduction to Nonrepudiation
Summary
Part III: In Practice
Chapter 10 -- Building a Secure Solution
Putting Together a Secure Solution
Speed vs. Security Trade-Offs
Configuration Checklists
Chapter 11 -- Troubleshooting Secure Solutions
Tools and Logs Available to You
The Art of Reading a Windows 2000 Logon Event
The Art of Reading an IIS Log Entry
Problems and Solutions
Chapter 12 -- Securing Against Attack
Why People Attack Web Servers
How People Attack Web Servers
Some Common Attacks
How to Detect Whether You re Under Attack
User Input Attacks
What to Do If You re Under Attack
Staying Up-to-Date on Security Issues
A Final Thought
Summary
Part IV: Reference
Chapter 13 -- Security Administration with ADSI, WMI, and COM
What Is WMI?
What Is ADSI?
Example Management and Security Configuration Code
Chapter 14 -- An Introduction to Kerberos Authentication in Windows 2000
What Is Kerberos Authentication?
How Kerberos Authentication Works
Helpful Tools
Kerberos Ticket Flow
Summary
Chapter 15 -- An Introduction to Cryptography and Certificates in Windows 2000
The Fundamentals of Cryptography
The Basics of Certificates
Cryptography and Certificates in Windows 2000
Summary
Bibliography
Appendix A -- Windows 2000 Well-Known SIDs
Appendix B -- Strong Passwords
How to Remember Strong Passwords
Appendix C -- Windows 2000 Default Ports
Appendix D -- Internet Information Services Authentication Summary
Anonymous Access (with the Allow IIS To Control Password option enabled)
Anonymous Access (with the Allow IIS To Control Password option disabled)
Basic Authentication
Digest Authentication
Integrated Windows Authentication
Client Certificate Mapping (IIS Mapping)
Client Certificate Mapping (Windows 2000 Active Directory Mapping)
Appendix E -- Security-Related IIS Server Variables
Appendix F -- Secure Web Server Checklist
General Security Considerations
Windows 2000 Security Considerations
IIS 5 Security Considerations
SQL Server Security Considerations
About the Authors
About This Electronic Book
About Microsoft Press