MSDN Magazine - November 2008 - (Page 8)

Editor’s NotE Can I See Some Identification? movie, and I had to purchase our tickets from a ticket agent who, as a result of an intercom system designed to transmit through half-inchthick glass, sounded like a synthesized voice run through a distorted amp. And imagine my surprise when I was asked for my ID because the movie was rated R. For anyone unfamiliar with the movie rating scale in the U.S., an R means individuals younger than 17 are not allowed to attend unless accompanied by an adult. Now, I realize that I probably look a bit younger than I am. But under 17? I showed my ID and purchased my movie tickets, but the incident caused me to think about some broader issues related to security requirements and context. One realization has to do with the thick sheet of glass separating me from the agent. I suspect that the actual reason for it is based in history, when most moviegoers used to purchase tickets using cash. And while the rise of credit cards may make it less common today, those folks behind the window still have to manage a lot of cash. Based on where most ticket counters are located relative to the rest of the theater, without that window (and the distorted intercom), the ticket agent would be extremely vulnerable to anyone with a broken moral compass and a desire for the cash. Another case where different contexts yield different security requirements is in age validation. If I’m buying tickets at the counter, I’m a captive audience—the agent can check my ID and verify my age with minimal effort or impact to the process of selling a ticket. But if I’m buying tickets online, while the business process reThanks To The following MicrosofT Technical experTs for Their help wiTh This issue: Paul Andrew, Jonathan Aneja, Bob Brumfield, Jeff Cao, Kiran Dowluru, Recently my wife and I went to see a mains consistent, the change in context shifts the security focus from protecting the assets of the movie theater (cash) to protecting the assets of the purchaser (credit card number). In a context where the ticket purchaser is essentially anonymous, deeper validation steps like ascertaining the purchaser’s age may seem superficial. As I’ve said many times, the number of technologies that must be integrated into our apps and enterprises is enormous, and it keeps growing. Additionally, each change in technology causes a change in the security context, potentially altering the security requirements. I have seen many projects start out with the simple goal of moving an existing app to the Web, only to later require a great deal of additional effort (or stall out completely) because the impact of the context change was not planned for up front. From the technology perspective, there’s no simple solution here. Security measures must be designed and implemented based on a proven understanding of the system, the users, and the context in which the system will be run. Given that, I firmly believe building secure systems has more to do with people and processes. We focus a lot of attention on the security development lifecycle (SDL). This is meant to underscore the idea that security is contextual and must be a standing discipline along with other major phases of a development lifecycle. As you will see in this issue, the SDL has also undergone some changes to remain achievable even in high-change environments where agile development methodologies are most effective. In fact, I guess you could say that the SDL is changing in response to a change in context. It is with great sorrow that we note the passing of Paul DiLascia, a long-time contributor to MSJ and MSDN Magazine and a friend to many of the staff here at the magazine. He shall be missed. Ryan Duguid, Mike Flasko, Matt Gibbs, Kevin Gjerstad, Christian Kleinerman, Bertrand Le Roy, Varsha Mahadevan, Duane Need, Wayne Norton, Eugene Osovetsky, Dave Reed, Michael Rys, Gerhard Schneider, and Michael Wang. Visit us at msdn.microsoft.com/magazine. Questions, comments, or suggestions for MSDN Magazine? Send them to the editor: mmeditor@microsoft.com. © 2008 Microsoft Corporation. All rights reserved. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, you are not permitted to reproduce, store, or introduce into a retrieval system MSDN Magazine or any part of MSDN Magazine. If you have purchased or have otherwise properly acquired a copy of MSDN Magazine in paper format, you are permitted to physically transfer this paper copy in unmodified form. Otherwise, you are not permitted to transmit copies of MSDN Magazine (or any part of MSDN Magazine) in any form or by any means without the express written permission of Microsoft Corporation. A listing of Microsoft Corporation trademarks can be found at microsoft.com/library/toolbar/3.0/trademarks/en-us.mspx. Other trademarks or trade names mentioned herein are the property of their respective owners. MSDN Magazine is published by United Business Media LLC. United Business Media LLC is an independent company not affiliated with Microsoft Corporation. Microsoft Corporation is solely responsible for the editorial contents of this magazine. The recommendations and technical guidelines in MSDN Magazine are based on specific environments and configurations. These recommendations or guidelines may not apply to dissimilar configurations. Microsoft Corporation does not make any representation or warranty, express or implied, with respect to any code or other information herein and disclaims any liability whatsoever for any use of such code or other information. MSDN Magazine, MSDN, and Microsoft logos are used by United Business Media under license from owner. 8 msdn magazine http://msdn.microsoft.com/magazine http://microsoft.com/library/toolbar/3.0/trademarks/en-us.mspx

Table of Contents Feed for the Digital Edition of MSDN Magazine - November 2008

Contents MSDN Magazine - November 2008 Toolbox CLR Inside Out Data Points Cutting Edge Security Briefs Test Your Security IQ Agile SDL Access Control Utility Spotlight RIA Test Run Wicked Code Foundations Team System End Bracket

MSDN Magazine - November 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.