How Do I Videos - Security Here you’ll find videos that explore a variety of security questions for developers, including encryption, handling attacks, security best practices, and a lot more. New videos are added regularly, so check back often. http://msdn2.microsoft.com/security/bb896640.aspxx en-US Fri, 4 Mar 2011 15:26:29 +0530 Fri, 4 Mar 2011 15:25:18 +0530 1440 FeedForAll v2.0 (2.0.2.9) http://www.feedforall.com banned.h Header File Overview The banned.h header file is a sanitizing resource, which helps deprecate unsafe functions, a security practice during the Implementation phase of the Security Development Lifecycle (SDL). banned.h lists all banned APIs and allows any developer to locate them in code.

Related resources:



]]> http://msdn.microsoft.com/en-us/security/gg675008.aspx 1B308CBF-922E-44E9-A1EA-9369273EB873 Fri, 4 Mar 2011 15:25:18 +0530 Code Analysis Tool .NET (CAT.NET) Overview 32-bit and 64-bit versions.
Related resources:
]]> http://msdn.microsoft.com/en-us/security/gg675009.aspx 96C41B0B-4468-47EF-8E91-64FEA7ED88CD Fri, 4 Mar 2011 01:59:40 +0530 MiniFuzz File Fuzzer Overview MiniFuzz File Fuzzer is a basic testing tool designed to help detect code flaws that may expose security vulnerabilities in file-handling code. This tool creates multiple random variations of file content and feeds it to the application to exercise the code in an attempt to expose unexpected and potentially insecure application behaviors.
Related Resource:
]]> http://msdn.microsoft.com/en-us/security/gg675011.aspx 5E5DBAEB-B6DF-44ED-9A95-4E3D6995ECE6 Fri, 4 Mar 2011 00:30:25 +0530 SDL Process Template for Visual Studio Team System Overview SDL Process Template for VSTS is a downloadable template that leverages the technology of Visual Studio Team System (VSTS) and Team Foundation Server (TFS) to automatically integrate the policy, process and tools associated with the Security Development Lifecycle (SDL) into your software development environment.
Related Resources:
]]> http://msdn.microsoft.com/en-us/security/gg638944.aspx 193AB158-306A-49E6-BAA9-E4E62EF03E98 Fri, 4 Mar 2011 00:19:23 +0530 Code Analysis for C/C++ Overview Code Analysis for C/C++ is a static analyzer that is provided with the installation of Visual Studio Team System or Visual Studio Team Suite, that provides information to developers about possible vulnerabilities in their C/C++ source code. Common coding errors reported by the tool include buffer overruns, un-initialized memory, null pointer dereferences, and memory and resource leaks.

Related resources:

]]> http://msdn.microsoft.com/en-us/security/gg675036.aspx 41F86959-AF8D-4C36-9F7D-1CB8704D31A3 Tue, 1 Mar 2011 07:34:31 +0530 SiteLock ATL Template Overview SiteLock ATL (Active Library Template) enables an ActiveX developer to restrict access so that a control is only deemed safe when used in a predetermined list of domains. This limits the ability of Web page authors to reuse the control for malicious purposes. This tool is to be used during the Implementation phase of the Microsoft Security Development Lifecycle (SDL).

Related resources:

]]> http://msdn.microsoft.com/en-us/security/gg675035.aspx B0342C11-E244-458E-903A-3ED8A1A8D6DE Tue, 1 Mar 2011 07:26:04 +0530 SDL Threat Modeling Tool Overview The SDL Threat Modeling Tool helps automate threat modeling, a security practice in the design phase of the Microsoft Security Development Lifecycle (SDL). The SDL Threat Modeling Tool is the first threat modeling tool which isn't designed for security experts. It makes threat modeling easier for all developers by providing guidance on creating and analyzing threat models.

Related resources:

]]> http://msdn.microsoft.com/en-us/security/gg674976.aspx 3B0CEA92-921E-4EB7-BAE0-266838FE7802 Tue, 1 Mar 2011 07:03:24 +0530 BinScope Binary Analyzer Overview BinScope Binary Analyzer is a verification tool that analyzes binaries on a project-wide level to ensure that they have been built in compliance with the Microsoft Security Development Lifecycle (SDL) requirements and recommendations. BinScope checks that SDL-required compiler/linker flags are being set, strong-named assemblies are in use, up-to-date build tools are in place, and the latest good ATL headers are being used. BinScope also reports on dangerous constructs that are prohibited by SDL. Related resources: Microsoft Security Development Lifecycle Tools The Verification Phase of the Microsoft SDL

Related resources:

]]> http://msdn.microsoft.com/en-us/security/gg638942.aspx 4A1E3DE0-1790-4A67-8033-4791B7BE5B2D Sat, 26 Feb 2011 01:23:16 +0530 How Do I: Perform the verification phase of the Microsoft SDL? In this video, Aviram Jenik, CEO, Beyond Security, talks about security practices of the Verification phase of the Microsoft Security Development Lifecycle. Aviram discusses more specifically the concept of “black box” testing, explains the importance of testing data entry endpoints with good, bad and fuzzed input, and points to the tools that can assist with these tasks. On a practical side, Aviram shows a detailed demo of “JPG fuzzing”, generating malformed images, and identifying vulnerabilities in image processing application. Related resources: <ul><li><a href="http://go.microsoft.com/?linkid=9708425 ">Whitepaper: The Simplified Implementation of the Microsoft SDL</a></li><li><a href="http://www.microsoft.com/security/sdl/default.aspx">Microsoft Security Development Lifecycle </a></li></ul> http://msdn.microsoft.com/en-us/security/gg674876.aspx 8405BA9F-38FC-4124-B0A8-06016A81A33F Sat, 26 Feb 2011 01:20:07 +0530 MSF-Agile+SDL Process Template for Visual Studio Team System Overview MSF-Agile+SDL Process Template for Visual Studio Team System 2008 and 2010 is a Team Foundation Server downloadable template that automatically incorporates the policy, process and tools associated with the SDL for Agile development guidance into the familiar Microsoft Solutions Framework (MSF) for Agile software development (MSF-Agile) process template that ships with Visual Studio Team System.

Related resources:
  • Microsoft Security Development Lifecycle Tools
  • Whitepaper: The Simplified Implementation of the Microsoft SDL
    • ]]> http://msdn.microsoft.com/en-us/security/gg649877.aspx AFBEC2AC-7823-4450-9D3A-7A5C6B20B8F4 Sat, 26 Feb 2011 01:03:22 +0530 How Do I: Perform the release phase of the Microsoft SDL? Related resources:

    • Whitepaper: The Simplified Implementation of the Microsoft SDL
    • Microsoft Security Development Lifecycle
      • ]]> http://msdn.microsoft.com/en-us/security/gg610710.aspx BDA41440-38E5-46C9-B50F-505A1698FD55 Fri, 25 Feb 2011 03:42:04 +0530 How Do I: Apply SDL Release practices within Windows Azure? Related resources:

      • Whitepaper: The Simplified Implementation of the Microsoft SDL
      • Whitepaper: Security Best Practices for Developing Windows Azure
      • Applications Microsoft Security Development Lifecycle Check out
      • Windows Azure Subscriptions
        • ]]> http://msdn.microsoft.com/en-us/security/gg638965.aspx D57F6E31-2313-484B-8B54-3A6F8FA9509C Fri, 25 Feb 2011 01:12:00 +0530 How Do I: Perform the design phase of the Microsoft SDL?
        Related resources:
        • Whitepaper: The Simplified Implementation of the Microsoft SDL
        • Microsoft Security Development Lifecycle
          • ]]> http://msdn.microsoft.com/en-us/Security/gg610503.aspx A0EFC8A9-8B8A-4C68-8F3B-36B9202C30F1 Thu, 24 Feb 2011 23:54:23 +0530 How Do I: Apply SDL Implementation practices within Windows Azure?
          Related resources:
          • Whitepaper: The Simplified Implementation of the Microsoft SDL
          • Whitepaper: Security Best Practices for Developing Windows Azure Applications
          • Microsoft Security Development Lifecycle
          • Check out Windows Azure Subscriptions
            • ]]> http://msdn.microsoft.com/en-us/security/gg610534.aspx 1FCE8BE6-2057-4888-A0AE-ACCA4084F6B4 Thu, 24 Feb 2011 18:01:54 +0530 How Do I: Apply SDL Design practices within Windows Azure?

            Related resources:

            ]]>             http://msdn.microsoft.com/en-us/security/gg610531.aspx 987C4C03-0E26-4BA6-9043-B40CB7DB73E6 Wed, 23 Feb 2011 15:09:18 +0530             How Do I: Apply SDL Requirements practices within Windows Azure? Casaba, speak about applying Microsoft SDL Requirements security practices to applications built on top of Windows Azure. The presenters explain the similarities and differences in planning for security and privacy when deploying to Windows Azure, and explain how to map the existing and new risks to the cloud-based environment.

            Related resources:

            ]]>             http://msdn.microsoft.com/en-us/security/gg609850.aspx DB67AA1E-6413-43FF-BB65-E3921FE47FFE Mon, 21 Feb 2011 13:56:50 +0530             How Do I: Perform the requirements phase of the Microsoft SDL? Casaba, speak about applying Microsoft SDL Requirements security practices to applications built on top of Windows Azure. The presenters explain the similarities and differences in planning for security and privacy when deploying to Windows Azure, and explain how to map the existing and new risks to the cloud-based environment.

            Related resources:

            ]]>             http://msdn.microsoft.com/en-us/security/gg609851.aspx 392B33F1-DCC6-4DA0-BAD4-2DB401359F14 Mon, 21 Feb 2011 13:55:38 +0530             Reducing your Application's Attack Surface The attack surface of an application is the set of ways in which an adversary can enter your software and potentially cause damage. The larger the attack surface, the more insecure the software. This webcast will present best practices for minimizing code exposed to untrusted users and protect against vulnerabilities and threats that you don’t know about. http://msdn.microsoft.com/en-us/Security/gg558149.aspx 6345718B-7C60-459B-B5B1-E0DEA3172EFB Tue, 1 Feb 2011 01:34:10 +0530 Security Innovation video: A Proactive Approach to Building a Successful Security Development Lifecycle A good offense starts with security as part of the whole development lifecycle and requires specialized security knowledge and tools that organizations can adopt quickly and with minimal disruption to their development process. Three industry leaders discuss why and how you can get your organization on the right path http://msdn.microsoft.com/en-us/security/gg615414.aspx C08FD008-29F3-4DCC-8074-35C20199AEBE Mon, 31 Jan 2011 16:05:47 +0530 The Art of Identifying, Assessing and Mitigating Software Risk Threat modeling is a key and powerful component of software risk management that organizations can use to identify risks and make better security decisions throughout design, coding, testing, and deployment. This Webcast will demonstrate how to characterize your business and technology from an attacker's viewpoint and determine the myriad of threats to your enterprise or application. http://msdn.microsoft.com/en-us/security/gg558148.aspx 0A0586FA-450C-404B-8533-6EFC47441980 Mon, 31 Jan 2011 11:41:46 +0530 Writing Secure Code in ASP.NET This webcast, delivered by a seasoned developer and software security expert, addresses common coding pitfalls and design errors and offers practical techniques developers can employ to minimize the likelihood of introducing vulnerabilities into their ASP.NET code. http://msdn.microsoft.com/en-us/security/gg558146.aspx 251A5DF0-5819-4CF8-A7AB-98D4376D15CD Mon, 31 Jan 2011 11:20:31 +0530 Six Key Security Activities for Software Engineering and Development Adopting a security engineering mindset to application development means that security is considered from project inception through deployment. This webcast will present six security engineering activities that can be leveraged to refine and extend their existing life cycle activities. http://msdn.microsoft.com/en-us/security/gg558145.aspx F066AAF2-2B80-459E-855E-9FF549B7EDFD Mon, 31 Jan 2011 10:59:07 +0530 Hunting Down Vulnerabilities in your Code: Effective Review Techniques A security-focused code review is one of the most important activities that you and your team can do in order to improve the security of your software. You can use a security code review to find vulnerabilities in code that is not yet ready to test or to find problems that would be very hard to find with testing techniques. This webcast describes the activities, process and tools that you need to find security problems in your code quickly and effectively. http://msdn.microsoft.com/en-us/security/gg558147.aspx FA5CD0E5-F1F9-4F5C-B6D9-3E5BA1038A37 Sat, 29 Jan 2011 03:22:44 +0530 How Do I: Use the Web Protection Library a.k.a Anti-XSS Library? MSDN – Security<br/> This video shows the additions to the Anti-XSS Library, as the new Web Protection Library (WPL) tool provides protection beyond just XSS vulnerabilities. It describes the Security Runtime Engine (SRE) and the Encoding Library. The latter contains HTML, LDAP and CSS encoding methods.</br> A CSS encoding sample is shown as well as a SRE demo on an e-commerce site showing how you can detect a real-time SQL Injection attack.</br> Download CTP: Microsoft Connect - Information Security Tools</br> Blogs on WPL: Security Tools </br> WPL Videos: Channel9 </br> More: <a href="http://www.msinfosec.com">www.msinfosec.com</a> http://msdn.microsoft.com/en-us/security/ee909461.aspx 16D9903F-F34D-446C-9D34-8E5649BC1417 Thu, 17 Dec 2009 01:07:25 +0530 How Do I: Identify and Fix Configuration Issues with WACA? MSDN – Security</br> This video shows how WACA (Web Application Configuration Analyzer) helps developers and testers try their applications in a secure environment. It also helps guarantee they will work in production with production configurations while unit testing. </br> This shows a quick demo of the application scanning a machine and it explains the scan results and shows how you can map it to TFS (Team Foundation Server).</br> Download CTP: Microsoft Connect - Information Security Tools</br> Blogs on WACA: Security Tools </br> WACA Videos: Channel9 </br> More: <a href="http://www.msinfosec.com">www.msinfosec.com</a> http://msdn.microsoft.com/en-us/security/ee909463.aspx 04C860AD-C9D0-4CBF-9015-612AC4125DBC Thu, 17 Dec 2009 00:58:48 +0530 How-Do-I: Sanitize HTML Using Anti-XSS Library 3.1?
            This new version of the Anti-XSS Library provides new features like HTML Sanitization which provides two new methods (AntiXss.GetSafeHtml and AntiXss.GetSafeHtmlFragments) to the Anti-XSS class to strip malicious characters or scripts off of HTML and returns safe HTML.

            To learn more about this application and stay up to date on the latest news, read the following blogs from Information Security and previous posts from the Security Tools Team blog
            Download Anti-XSS Library]]>             http://msdn.microsoft.com/en-us/security/ee658075.aspx 9E4743F3-FC58-4288-BE0B-6825E867AE25 Thu, 8 Oct 2009 01:36:58 +0530             How Do I: Defend Against Truncation-Based SQL Injection Attacks? Escaping single quote characters is sometimes used as mitigation for SQL injection vulnerabilities. On the other hand, when data assigned to a SQL Server character variable exceeds the defined length for that variable, the extra characters get truncated. This video demonstrates how this property of truncation may be used by an attacker to circumvent the above mentioned mitigation, resulting in a SQL injection attack. Various options of fixing SQL injection issues are also discussed. http://msdn2.microsoft.com/security/ee216344.aspx 5148A3AF-E33C-4FCE-B5A1-71DE6AF41398 Sat, 11 Jul 2009 04:16:07 +0530 How Do I: Secure SQL Server using SQL Server 2008 Policy Based Management? SQL Server 2008 introduced a new feature known as Policy Based Management (PBM). This feature allows us to create policies for our SQL server instance. Few important features of Policy Based Management are: <br /> - It is similar to group policy feature provided by Windows<br /> - We can create SQL Server Policies and deploy these policies across multiple servers<br /> - Policies can be scheduled or we can run them on demand<br /> - Policy can also rollback the transaction (policy violating transactions) with raising an error<br /> In this video I’ll showcase how we can leverage Policy Based Management to secure our SQL server environment. I’ll introduce you with these basics of PBM and we will see how we can build policies related to SQL server security and assess those policies on our SQL Server instance. http://msdn2.microsoft.com/security/ee216343.aspx F1127CB2-4A9C-4DAD-9295-F0196A2D30A5 Sat, 11 Jul 2009 01:53:28 +0530 How Do I: Change Default Work Items in the SDL Process Template? This video will show you how to modify the default work items that are included in the SDL Process Template. We will cover how to modify the default work items that are created in your new SDL Process Template team project. We will also review how to modify the default work item types - such as Task or Bug. The Microsoft SDL Process Template for Visual Studio Team System was created to ease adoption of the SDL by automatically integrating the policy, process and tools of the Security Development Lifecycle v4.1 into Visual Studio Team System 2008. http://msdn2.microsoft.com/security/dd867638.aspx 9AB6E68K-B3F4-483E-C017-7A2FC399738E Tue, 19 May 2009 15:20:45 -0700 How Do I: Use the SDL Process Template Documentation and Reporting? This video will show you how to use the SDL Process Template document templates and security metrics reporting. The built in SDL document templates will help you jump start your use of the Microsoft SDL. The reporting will allow you to improve your visibility into the key security risks for your application and the progress your team is making toward their security goals. The Microsoft SDL Process Template for Visual Studio Team System was created to ease adoption of the SDL by automatically integrating the policy, process and tools of the Security Development Lifecycle v4.1 into Visual Studio Team System 2008. http://msdn2.microsoft.com/security/dd867639.aspx 9AB6E67G-B3F4-483E-C017-7A2FC399738E Tue, 19 May 2009 15:20:45 -0700 How Do I: Set Up the SDL Process Template? In this video we will first show you how to install the SDL Process Template. Then we will walk you through how to begin using it in your new project. The Microsoft SDL Process Template for Visual Studio Team System was created to ease adoption of the SDL by automatically integrating the policy, process and tools of the Security Development Lifecycle v4.1 into Visual Studio Team System 2008. http://msdn2.microsoft.com/security/dd819921.aspx 9AB6E67A-B3F4-483D-C017-7A2FC399738E Tue, 19 May 2009 15:20:45 -0700 How Do I: Improve My Check-In Process? In this video we will introduce you to the SDL Process Template check-in policies and then show you how to enable the check-in policies for yourself and your team. Finally, we will demonstrate the check-in policies in action as well as how you can be alerted when someone overrides a check-in policy. http://msdn2.microsoft.com/security/dd819920.aspx 9AB6E67A-B3F4-483D-C017-7A2FC399738A Tue, 19 May 2009 15:20:45 -0700 How Do I: Evaluate my site’s performance with neXpert? This How-Do-I video shows you how to use neXpert, an add-on to Fiddler, which automates the classic performance best practice checks and produces a HTML report on the issues found in a Fiddler capture. neXpert adds the ability to insert step markers in Fiddler sessions to associate network objects together (create transactions). Using these steps, neXpert looks for performance issues and generates a HTML report based on the findings. http://msdn2.microsoft.com/security/dd573302.aspx 9AB6E67A-B3F4-483F-C017-7A2FC399738A Sun, 22 Feb 2009 15:20:45 -0700 How Do I: Use .NET Framework’s Code Access Security? As you know, if you use .NET Framework, you can already develop in Azure. That's great news as you can apply these techniques to your cloud app. Join Katheryn Baker as she explains the basics of the integrated security model, Code Access Security, in the .Net Framework. Learn more about how Code Access Security works conceptually, and how to implement it with a simple application. http://msdn2.microsoft.com/security/dd442474.aspx 9AB6E67A-B3F4-483F-B017-7A2FC489738A Thu, 5 Feb 2009 15:20:45 -0700 How Do I: Use Smart Encryption Techniques for Cloud Apps? As you know, if you use Visual Studio, you can already develop in Azure. That’s great news as you can apply encryption to your cloud app. Join Katheryn Baker as she explains the basics behind encryption algorithms and practices used to create cryptographic schemes. Learn more about symmetric and asymmetric encryption algorithms, the SHA256 hash encryption algorithms, and how to implement in a simple application. http://msdn2.microsoft.com/security/dd442480.aspx 9AB6E67A-B3F4-483F-B017-7A2FC399738A Thu, 5 Feb 2009 15:20:45 -0700 How Do I: Use .NET Framework’s Code Access Security? As you know, if you use .NET Framework, you can already develop in Azure. That's great news as you can apply these techniques to your cloud app. Join Katheryn Baker as she explains the basics of the integrated security model, Code Access Security, in the .Net Framework. Learn more about how Code Access Security works conceptually, and how to implement it with a simple application. http://msdn2.microsoft.com/security/dd442474.aspx 9AB6E67A-B3F4-483F-B017-7B2FC399738A Thu, 5 Feb 2009 15:20:45 -0700 How Do I: Export and Import Certificates? In this How-Do-I video, Lamees Ayman will show us how to export and import certificates. http://msdn2.microsoft.com/security/cc424865.aspx 0D0D1D88-3052-41A6-8164-47BB5AB8D4CA Tue, 25 Mar 2008 15:21:34 -0700 How Do I: Attach Client Credentials to a Web Service Call For Security? Create an ASP.NET 2.0 Web reference and a Windows Communication Foundation service reference to an ASMX Web service using Visual Studio 2008. Join Rob Windsor as he demonstrates this and how to attach client credentials to calls made to the service using both kinds of client-side proxy. http://msdn2.microsoft.com/security/cc178918.aspx 9720B98D-034B-4775-B949-364627B56EAC Tue, 25 Mar 2008 22:54:31 -0800 How Do I: Secure Data Using Asymmetric Key Encryption? In this how-to video, Remon Zakaria will demonstrate how to secure your data by encrypting it using Asymmetric encryption algorithms. http://msdn2.microsoft.com/security/cc307275.aspx 73D5509A-095F-4104-8C7A-9E65C3D92319 Tue, 4 Mar 2008 22:54:01 -0800 How Do I: Secure Passwords Using Hashing Algorithms? In this how-to video, Remon Zakaria will remind us with the symmetric key encryption techniques in .Net framework 2.0. http://msdn2.microsoft.com/security/cc307276.aspx 9720B98D-034B-4775-B949-364627B96EAC Tue, 4 Mar 2008 22:54:31 -0800 How Do I: Secure Data Using Symmetric Key Encryption? In this how-to video, Remon Zakaria will remind us with the symmetric key encryption techniques in .Net framework 2.0. http://msdn2.microsoft.com/security/cc307274.aspx 17D1FE23-7D01-4AC5-A1DF-9DE62F94BB20 Tue, 4 Mar 2008 22:53:22 -0800 How Do I: Add Security to Applications Built with Visual Basic.Net and C#? In this video Will DePalo demonstrates how to add security to the applications that you build with Visual Basic.Net and C# by having multiple parties digitally sign documents to insure message integrity and authenticity. http://msdn2.microsoft.com/security/cc263920.aspx 2E782235-0957-4FE2-93CC-3CE26601FC02 Tue, 12 Feb 2008 17:33:44 -0800 How Do I: Create a Generic Principal for Role Based Security? Using the GenericPrincipal class, you can create an authorization scheme that exists independent of a Windows NT or Windows 2000 domain or simply use your own custom role scheme. In this video, Todd Miranda demonstrates how to create and use a Generic Principal. http://msdn2.microsoft.com/security/cc263917.aspx 12C43341-FDB9-49BB-9DF5-90D43706D44A Tue, 12 Feb 2008 17:32:59 -0800 How Do I: Create a Windows Principal for Role Based Security? Using the WindowsPrincipal class, you can create an authorization scheme that ties into a Windows NT or Windows 2000 domain. In this video, Todd Miranda demonstrates how to create and use a Windows Principal. http://msdn2.microsoft.com/security/cc263915.aspx 9AA2284F-88E1-4748-9F28-39F58E0F9E5E Tue, 12 Feb 2008 17:32:21 -0800 How Do I: Perform Imperative Security Checks? Restricting access to code that could potentially be used to perform malicious actions is often overlooked but very important. Imperative security checks allow you to protect your application code by requiring appropriate permissions prior to execution. In this video, Todd Miranda demonstrates how to perform imperative http://msdn2.microsoft.com/security/cc263910.aspx F652E932-D15A-4143-8011-C4E46703AD03 Tue, 12 Feb 2008 17:31:44 -0800 How Do I: Add Hashing to Existing Application? In this video, Eric Marvets shows us how to add a hashing routine to an existing application. http://msdn2.microsoft.com/security/cc261634.aspx 827EA364-D859-42B3-8AD6-0B577D73D2A3 Tue, 12 Feb 2008 17:30:50 -0800 How Do I: Improve Cryptographic Security by Storing Keys in Containers? One of the challenges of encrypting data with keys is determining where to store the keys securely. You can store keys in named containers. These named containers utilize Windows security to securely store cryptographic keys. In this video, Todd Miranda demonstrates how to store asymmetric keys in a key container. http://msdn2.microsoft.com/security/cc261628.aspx 3ADC6618-7E80-47E7-AD8B-949C23A507AF Tue, 12 Feb 2008 17:29:40 -0800 How Do I: Create a Secure Custom Membership Provider? In this how-to video, Remon Zakaria will remind us with the SQL Membership provider and show us how to create a custom Membership provider that does the same job as the SQL Membership Provider. http://msdn2.microsoft.com/security/cc185719.aspx 7E4907E4-1EA0-4C3A-BD57-04F095012A37 Tue, 5 Feb 2008 18:37:49 -0800 How Do I: Improve Data Security by Encrypting and Decrypting XML Data Using Asymmetric Keys? Transmitting and saving XML data is very popular but the plain text nature of XML makes using it for sensitive data difficult. Encrypting XML data is not difficult with the objects available in .NET. In this video Todd Miranda demonstrates how to encrypt and decrypt XML data using Asymmetric Keys. http://msdn2.microsoft.com/security/cc185724.aspx 55BE4ADD-EE27-414B-AC72-BFE6A6205DF1 Tue, 5 Feb 2008 18:37:19 -0800 How Do I: Improve Data Security by Encrypting and Decrypting XML Data Using Symmetric Keys? Transmitting and saving XML data is very popular but the plain text nature of XML makes using it for sensitive data difficult. Encrypting XML data is not difficult with the objects available in .NET. In this video Todd Miranda demonstrates how to encrypt and decrypt XML data using Symmetric Keys. http://msdn2.microsoft.com/security/cc185725.aspx A7881E89-5F0C-4E46-8FAD-5326E39AB202 Tue, 5 Feb 2008 18:36:43 -0800 How Do I: Integrate SqlMembership Provider into My Existing Database? In this how-to video, Remon Zakaria will remind us with the “Setting up SqlMembership provider” demo and show how to use the SqlMembership provider inside your existing website’s database using aspnet_regsql.exe command. http://msdn2.microsoft.com/security/cc178919.aspx n8iw39-5262-407a-8996-9dac1441756f Tue, 29 Jan 2008 20:41:57 +0000 How Do I: Set up SqlMembership Providers? In this how-to video, Remon Zakaria will explain the concept of Membership providers and demonstrate how to setup and use the SQLMembership provider that is built-in ASP.NET 2.0. http://msdn2.microsoft.com/security/cc178926.aspx sw3h39-5262-407a-8996-9dac1441756f Tue, 29 Jan 2008 20:41:57 +0000 How Do I: Add Security to Applications by Digitally Signing XAML Documents? In this video you will learn how to add security to the application you build with C# and Visual Basic.NET by digitally signing XAML documents. http://msdn2.microsoft.com/security/cc178920.aspx nu8o39-5262-407a-8996-9dac1441756f Tue, 29 Jan 2008 20:41:57 +0000 How Do I: Digitally Sign Documents with the Signature of a Single Party? In this video Will DePalo demonstrates how to add security to the applications that you build with Visual Basic.Net and C# by digitally signing documents with the signature of a single party to insure message integrity and authenticity. http://msdn2.microsoft.com/security/cc178921.aspx s24t39-5262-407a-8996-9dac1441756f Tue, 29 Jan 2008 20:41:57 +0000 How Do I: Add Security to Visual Basic and C# Applications with Digital Signatures? In this video Will DePalo demonstrates how to add security to the applications that you build with Visual Basic.Net and C# by verifying the digital signatures on XML documents to insure message integrity and authenticity. http://msdn2.microsoft.com/security/cc178917.aspx vt6739-5262-407a-8996-9dac1441756f Tue, 29 Jan 2008 20:41:57 +0000 How Do I: Add Security to .Net Applications with the ProtectedData Class? In this video Will DePalo demonstrates how to add security to .Net applications by encrypting sensitive or confidential data by using the ProtectedData class of the System.Security.Cryptography namespace. http://msdn2.microsoft.com/security/bb986172.aspx wllp39-5262-407a-8996-9dac1441756f Tue, 8 Jan 2008 22:32:07 +0000 How Do I: Use Managed Cards in Windows CardSpace to Increase the Security of My Web Site? In this video Scott Golightly walks through the process of setting up a sample Security Token Service (STS). The STS is used to issue managed cards that will be accepted at a web site. Scott shows how to create a managed card based on a personal card in CardSpace and also how to create a managed card based on a user name and password. http://msdn2.microsoft.com/security/bb977432.aspx rv7u39-5262-407a-8996-9dac1441756f Tue, 18 Dec 2007 20:52:34 +0000 How Do I: Prevent a SQL Injection Security Flaw in an ASP.NET Application? SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of SQL Server for parsing and execution. SQL Injection attacks are typically the result of misplaced trust in the data inputs to a system. In this video, Todd Miranda demonstrates a simple SQL Injection attack and how to prevent it. http://msdn2.microsoft.com/security/bb977435.aspx i90q39-5262-407a-8996-9dac1441756f Tue, 18 Dec 2007 20:52:34 +0000 How Do I: Add Security to Visual C++ Applications? In this video Will DePalo will demonstrate how to add security to the applications that you build with Visual C++ by encrypting data with the Data Protection Application Programming Interface (DPAPI). http://msdn2.microsoft.com/security/bb980212.aspx b8is39-5262-407a-8996-9dac1441756f Tue, 18 Dec 2007 20:52:34 +0000 How Do I: Prevent a SQL Injection Attack Over a PHP/MySQL/Linux Platform? In this how-to video, Remon Zakaria will explain and demonstrate the SQL Injection attack over a PHP/MySQL/Linux Platform and how can you protect yourself from it. http://msdn2.microsoft.com/security/bb980214.aspx 5m9a39-5262-407a-8996-9dac1441756f Tue, 18 Dec 2007 20:52:34 +0000 How Do I: Prevent a Cross Site Request Forgery Security Flaw in an ASP.NET Application? Cross Site Request Forgery is an attack that enables an attacker to send arbitrary HTTP requests from a victim user. In this video, Todd Miranda demonstrates a simple Cross Site Request Forgery attack and how to prevent it. http://msdn2.microsoft.com/security/bb977433.aspx rt6n39-5262-407a-8996-9dac1441756f Tue, 11 Dec 2007 21:56:15 +0000 How Do I: Encrypt My Web.Config File? In this video, Hilton Giesenow demonstrates how to securely encrypt sections of your web.config file. The video covers the two out-of-box encryption providers, command-line encryption, and encryption from within your application. http://msdn2.microsoft.com/security/bb977434.aspx tb2339-5262-407a-8996-9dac1441756f Tue, 11 Dec 2007 21:56:15 +0000 How Do I: Use Discretionary Access Control Lists in Windows? In this video, Will DePalo discusses discretionary access control lists, a major security component of the Windows operating system. See how to grant and deny access to the files you create in Visual C++ applications by manipulating their access control lists. http://msdn2.microsoft.com/security/bb968862.aspx 5t2g39-5262-407a-8996-9dac1441756f Sun, 4 Mar 2007 21:56:15 +0000 How Do I: Increase Web Site Security by Integrating Cardspace and ASP.NET for Login? In this video, Scott Golightly shows how to increase the security of Web sites by allowing users to use a Windows CardSpace information card to log in to a Web site. http://msdn2.microsoft.com/security/bb968865.aspx 9isx39-5262-407a-8996-9dac1441756f Tue, 11 Dec 2007 21:56:15 +0000