This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP .NET Recommended Resources"

From OWASP
Jump to: navigation, search
(Added Resources)
 
(3 intermediate revisions by one other user not shown)
Line 10: Line 10:
 
==OWASP .NET Recommended Resources==
 
==OWASP .NET Recommended Resources==
  
 
+
This is a canonical list of outside resources for .NET developers seeking security information.
===Areas of Concern===
 
 
 
*Getting Started
 
 
 
*Tutorials
 
 
 
*Best Practices
 
 
 
*OWASP Guidance and Tools
 
  
 
===Blogs & People===
 
===Blogs & People===
  
===== OWASP =====
 
[https://lists.owasp.org/pipermail/owasp-phoenix/2009-May/000079.html OWASP-Phoenix List Reply regarding GSSP .NET Cert] from [http://twitter.com/atdre Dre]
 
 
==== General ====
 
 
[http://securitybuddha.com/ Mark Curphrey's Blog]
 
[http://securitybuddha.com/ Mark Curphrey's Blog]
  
Line 40: Line 27:
  
 
[http://www.troyhunt.com/ Troy Hunt's Blog]
 
[http://www.troyhunt.com/ Troy Hunt's Blog]
 +
 +
[https://www.preemptive.com/blog App Protection Blog]
  
 
===Advisories, Articles & Projects===
 
===Advisories, Articles & Projects===
Line 64: Line 53:
  
 
[http://www.microsoft.com/technet/security/advisory/954462.mspx Microsoft Security Advisory (954462) (SQL Injection Advisory)]
 
[http://www.microsoft.com/technet/security/advisory/954462.mspx Microsoft Security Advisory (954462) (SQL Injection Advisory)]
 +
 +
[https://www.microsoft.com/en-us/sdl Security Development Lifecycle]
  
 
===Online References, Training===
 
===Online References, Training===
Line 76: Line 67:
  
 
[http://www.troyhunt.com/2010/05/owasp-top-10-for-net-developers-part-1.html OWASP Top 10 for .NET developers - Troy Hunt]
 
[http://www.troyhunt.com/2010/05/owasp-top-10-for-net-developers-part-1.html OWASP Top 10 for .NET developers - Troy Hunt]
 +
 +
[http://www.teammentor.net/teamMentor TeamMentor]
 +
 +
[https://docs.microsoft.com/en-us/dotnet/standard/security/ Security in the .NET Framework]
  
 
===Books and Publications===
 
===Books and Publications===
Line 93: Line 88:
 
===Tools===
 
===Tools===
  
[http://www.microsoft.com/downloads/details.aspx?familyid=59888078-9daf-4e96-b7d1-944703479451&displaylang=en Microsoft Threat Analysis & Modeling v2.1.2]
+
[http://blogs.msdn.com/b/sdl/archive/2014/04/15/introducing-microsoft-threat-modeling-tool-2014.aspx Microsoft Threat Modeling Tool 2014]
 
 
[http://www.codeplex.com/guidanceExplorer Patterns and Practices Guidance Explorer]
 
 
 
[http://blogs.msdn.com/alikl/archive/2007/03/26/security-net-code-inspection-using-outlook-2007.aspx Security Code Review Checklist Generator]
 
  
 
[http://msdn.microsoft.com/en-us/security/aa973814.aspx Anti-Cross Site Scripting]
 
[http://msdn.microsoft.com/en-us/security/aa973814.aspx Anti-Cross Site Scripting]
Line 105: Line 96:
 
[http://support.microsoft.com/kb/954476 Microsoft Source Code Analyzer]
 
[http://support.microsoft.com/kb/954476 Microsoft Source Code Analyzer]
  
[http://www.communities.hp.com/securitysoftware/blogs/spilabs/archive/2008/06/23/finding-sql-injection-with-scrawlr.aspx Scrawlr]
+
[http://support.microsoft.com/kb/954476 MS Source Code Analyser for SQL Injection]
  
[http://support.microsoft.com/kb/954476 MS Source Code Analyser for SQL Injection]
+
[https://docs.microsoft.com/en-us/visualstudio/ide/dotfuscator/ Visual Studio .NET Obfuscator]

Latest revision as of 12:39, 11 May 2018

OWASP .NET Quick Reference

OWASP .NET Recommended Resources

This is a canonical list of outside resources for .NET developers seeking security information.

Blogs & People

Mark Curphrey's Blog

Michael Howard's Blog

J.D. Meier's Blog

Dominick Baier's Blog

Shawn Farkas' Blog

Microsoft's ACE Team

Troy Hunt's Blog

App Protection Blog

Advisories, Articles & Projects

Security and Operational Guidance for .NET Applications

ASP.NET Security Architecture

patterns & practices Security Engineering Index

patterns & practices Security Guidance for Applications Index

patterns & practices Security Guidance for .NET Framework 2.0

Authentication in ASP.NET: .NET Security Guidance

Security Engineering

Solutions to SOA Security

Web Service Specifications

Security Guidance for Windows Communication Foundation

Microsoft Security Advisory (954462) (SQL Injection Advisory)

Security Development Lifecycle

Online References, Training

Patterns and Practices

MSDN Security Developer Center

Microsoft Security Resources

Pluralsight Security Course Catalog

OWASP Top 10 for .NET developers - Troy Hunt

TeamMentor

Security in the .NET Framework

Books and Publications

Writing Secure Code, Michael Howard and David LeBlanc

Microsoft Security Development Lifecycle 3.2

Building Secure ASP.NET Applications: Authentication, Authorization, and Secure Communication, J.D. Meier, Alex Mackman, Michael Dunner, and Srinath Vasireddy

Improving Web Application Security: Threats and Countermeasures, J.D. Meier, Alex Mackman, Michael Dunner, Srinath Vasireddy, Ray Escamilla and Anandha Murukan

Developer Highway Code, Microsoft Corp, United Kingdom

Security Driven .NET, Stan Drapkin

Tools

Microsoft Threat Modeling Tool 2014

Anti-Cross Site Scripting

URLScan

Microsoft Source Code Analyzer

MS Source Code Analyser for SQL Injection

Visual Studio .NET Obfuscator