OWASP .Net Project Roadmap - Revision history

Bill Sempf: Replaced content with " Category:OWASP .NET Project"

2016-01-30T22:00:22Z

Replaced content with " Category:OWASP .NET Project"

Bill Sempf: /* Components */

2016-01-30T21:58:39Z

‎Components

Bill Sempf: Undo revision 207731 by Bill Sempf (talk)

2016-01-30T21:57:36Z

Undo revision 207731 by Bill Sempf (talk)

Bill Sempf: Moving components to the Resources page

2016-01-30T21:56:24Z

Moving components to the Resources page

Bill Sempf: Moving completed stuff to the Resources tab

2016-01-30T21:55:58Z

Moving completed stuff to the Resources tab

Bill Sempf: /* Guidance */ Promoted PBKDF2 and Anti-CSRF

2015-02-16T15:49:14Z

‎Guidance: Promoted PBKDF2 and Anti-CSRF

Bill Sempf: /* Needed guidance */

2014-11-26T16:39:25Z

‎Needed guidance

Bill Sempf: /* Completed guidance */

2014-11-26T16:39:11Z

‎Completed guidance

Bill Sempf: /* In-process guidance */

2014-11-26T16:38:59Z

‎In-process guidance

Bill Sempf: /* Completed guidance */

2014-10-29T15:57:18Z

‎Completed guidance

← Older revision		Revision as of 22:00, 30 January 2016
Line 1:		Line 1:
−	~~= Overview =~~

−	The .NET Framework has seen significant security improvement over the last ten years of development. With proper use the core security problems that are seen in web applications, or even Windows executibles, are difficult to exploit.
−
−	The key is 'proper use' and that is the goal of the .NET Project - assist with proper use. Education, components and tools that are appropriate for the latest .NET versions should be the focus for output of this project. As tools and information become out of date, they will be moved to a sunset mode, still available to those using older versions of the framework.
−
−	~~= Themes =~~
−	~~The themes of the .NET Project include:~~
−	* Deep, rich guidance for .NET developers using the security features of .NET
−	* Access to use of OWASP components that are designed for use with .NET
−	* Information about working with and on OWASP tools built using .NET
−
−	~~= Features =~~
−
−	Features are parts of the project at a very high level. There are three themes, and they include guidance for developers, components that help to write more secure .NET projects, and tools for general security and testing written in .NET.
−
−	~~== Guidance ==~~
−
−	~~Guidance is documentation that assists .NET developers implementing the security features of the framework.~~
−
−	~~=== In-process guidance ===~~
−
−	* [[Windows Identity Foundation]]
−	* [[.NET Memory Management]]
−
−	~~=== Needed guidance ===~~
−
−	* [[ASP.NET Identity]]
−	* [[DPAPI]]
−	* [[ClickOnce Deployment]]
−	* [[.NET Callbacks - Vulnerabilities and Remediation]]
−	* [[Dependency Injection]]
−	* [[IoC containers]]
−	* [[Preventing SQL Injection in ADO.NET]]
−	* [[Authenticated Symmetric Encryption in .NET]]
−
−	~~== Components ==~~
−
−	Components are pieces of software that assist .NET developers in building more secure code. A number of projects exist that are for older versions of .NET. While they are no longer valid for later versions, they are still acceptable for use. Many updates are needed to a number of other projects.
−
−	~~=== Needed Components ===~~
−
−	~~Please suggest needed components.~~
−
−	~~== Projects that use .NET ==~~
−
−	~~These are projects that happen to be built in .NET. Many of them could use .NET development assistance:~~
−
−	* [[OWASP O2 Platform]]
−	* [https://www.owasp.org/index.php/Category:OWASP_WebGoat.NET WebGOAT.NET]
−
−	~~= Ideas =~~
−	~~Please send your ideas to the OWASP.Net mailing list (owasp-dotnet@lists.owasp.org)~~

@@ Line 39: / Line 39: @@
 Components are pieces of software that assist .NET developers in building more secure code. A number of projects exist that are for older versions of .NET. While they are no longer valid for later versions, they are still acceptable for use. Many updates are needed to a number of other projects.
-* [https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=Dot_NET ESAPI.NET]
+=== Needed Components ===
-* [[.Net CSRF Guard]]
-* [https://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project_.NET AntiSamy .NET]
+Please suggest needed components.
 == Projects that use .NET ==

@@ Line 34: / Line 34: @@
 * [[Preventing SQL Injection in ADO.NET]]
 * [[Authenticated Symmetric Encryption in .NET]]
 = Ideas =

@@ Line 34: / Line 34: @@
 * [[Preventing SQL Injection in ADO.NET]]
 * [[Authenticated Symmetric Encryption in .NET]]
 = Ideas =

← Older revision		Revision as of 21:55, 30 January 2016
Line 18:		Line 18:

	Guidance is documentation that assists .NET developers implementing the security features of the framework.		Guidance is documentation that assists .NET developers implementing the security features of the framework.
−
−	~~=== Completed guidance ===~~
−
−	* The [[.NET Security Cheat Sheet]]
−	* [[.NET Penetration Testing]]
−	* [[Exception Handling]]
−	* [[ASP.NET Request Validation]]
−	* [[ASP.NET Output Encoding]]
−	* [[Using Rfc2898DeriveBytes for PBKDF2]]
−	* [[Anti CSRF Tokens ASP.NET]]

	=== In-process guidance ===		=== In-process guidance ===

@@ Line 26: / Line 26: @@
 * [[ASP.NET Request Validation]]
 * [[ASP.NET Output Encoding]]
 === In-process guidance ===
 * [[Windows Identity Foundation]]
 * [[.NET Memory Management]]

@@ Line 37: / Line 37: @@
 * [[ASP.NET Identity]]
 * [[DPAPI]]
 * [[ClickOnce Deployment]]

@@ Line 24: / Line 24: @@
 * [[.NET Penetration Testing]]
 * [[Exception Handling]]
 === In-process guidance ===

@@ Line 31: / Line 31: @@
 * [[Anti CSRF Tokens ASP.NET]]
 * [[.NET Memory Management]]
 === Needed guidance ===