"Web-based applications" is getting to be a redundant term, but that only highlights the fact that up-to-date programmers need to be familiar with the strategies and practices used to build modern networked software. Designing Secure Web-Based Applications for Microsoft Windows 2000 explains precisely what its title specifies: the mechanisms for allowing Windows programs to communicate over the network while maintaining security, plus their ways of fitting into complete product architectures. It's a complete engineering document with considerable information on identifying security threats, giving them relative weight, and deciding how to deal with them in the designs of your systems. The author has both done his homework and worked in the industry, and it's a pleasure to read his distilled knowledge.
Early sections are rather academic (which is not to say they're not worthwhile), while later sections deal with specific security strategies and the security features of particular products. The author isn't vague--he tells you how he thinks you should design your programs (storing hashes, instead of passwords, in a database to allow for intrusion into the database, for example) and what specifically you need to do (there's enough code here to give heft to what otherwise would be purely high-level advice). Although the author sticks to the Microsoft world, he isn't reluctant to point out security problems in Windows. This is a great volume for anyone designing Windows software that will share information over a network and need to use authentication, nonrepudiation, encryption, and other security techniques. --David Wall
Topics covered: Network security features of Windows 2000, Internet Explorer 5.0, SQL Server 7.0, SQL Server 2000, and COM+ 1.0, as well as the engineering tradeoffs involved in making software secure enough for safety, but open enough for reliability.
Product Description
Bullet-proof security is one of the strengths of Microsoft Windows 2000, but until now, no one has presented a complete picture of Windows 2000 Web server, component-level, and database security features and considerations. DESIGNING SECURE WEB-BASED APPLICATIONS FOR MICROSOFT WINDOWS 2000 offers an integrated, authoritative, pragmatic, end-to-end view of Windows 2000 security topics. The book starts by providing a solid foundation in Windows 2000 security theory and concepts, explaining the key software design considerations for various categories and levels of security, and showing how isolated security "islands" interact. It explains core security issues such as risk analysis, threats, authentication, authorization, and privacy, and then discusses ways to apply the appropriate security to an application to mitigate risk. It covers a range of security technologies such as NTLM authentication, Kerberos authentication, SSL/TLS, CryptoAPI, ACLs, Active Directory(tm), Certificates, Web security capabilities, and COM+ security. Finally, the author uses Web services, certificates, components, and database access to build a Web-based application (included on a companion CD) to show how Windows 2000 security features work in concert to protect applications and data.
