• After six month, I almost finished developing my last course : Application Security! The following are topics that is discussed in this course :

 Session 1 -Introduction

  • Introduction to Security
  • Main Concepts
  • Authentication, Authorization, Auditing
  • Confidentiality, Integrity, Availability

 

Session 2- Top Ten Security Bugs (1)

  • SQL Injection
  • DOM-based XSS
  • Stored XSS
  • HTTP Response Splitting
  • Cross-site Request Forgery

 

Session 3- Top Ten Security Bugs (2)

  • Predictable Cookie
  • Hidden Fields
  • Executing Code with Too much Privilege
  • Mobile Code
  • Use of Weak Password-based System

 

Session 4- Thread Modeling

  • STRIDE Approach
  • Microsoft Security Development Lifecycle (SDL)
  • Session 5- Code Access Security
  • CAS Basics
  • Writing Secure Assemblies
  • Controlling Access Permission

 

Session 6- Cryptography

  • Hashing
  • Symmetric Algorithms
  • Asymmetric Algorithms

 

Session 7- ASP.Net Security

  • Forms Authentication/Membership/Role Management Overview
  • Implementing Custom Role Provider
  • Top Ten Security Mistakes in ASP.Net

 

Session 8- IIS/ SQL Server Security

  • Authentication in IIS
  • Implementing HTTPS

 

Session 9- Active Directory

  • Active Directory Integration
  • Active Directory Application Mode (ADAM)
  • Active Directory Federation Services Overview

 

Session 10- WCF Security

  • Security Types
  • Using Certificates
  • Federated Security Overview

 

Session 11- Designing Authentication/Cryptography Mechanisms

  • Implementing Single-Sign-On
  • Using Application Service Client Profile
  • Using Security Application Block

 

Session 12- Designing Authorization Mechanism

  • RBAC Standard
  • Using Authorization Manager

 

Session 13- ISO 27001 Overview

  • Basics of ISO 27001
  • ISO 27001 Processes

 

Session 14- Security Tools

  • Code Analysis Tools
  • Thread Modeling Tools
  • Security Test Tools
Tags: , , ,
Comments (3)

What is your first step in solving performance issues in an existing application? Yeah, You answer me that I must be proactive in performance modeling. But we live in real world, we can't prepare ourselves for future performance issues, in advance. Assume our customer is not satisfied about application performance, what is our first step to identify the exact point of performance issue. I think the first step is thinking structurally and modeling the application in performance perspective. The following is the initial list for thinking structurally to model the points that affects the performance of the application (I assume you have a LOB application that was deployed 3-tier):

·         Database Server - Data Tier

o    RDBMS

§  Physical File Design

§  Example: Spreading filegroups in different physical hard drives.

§  Logical Database Design

§  Denormalization

§  Partitioning

§  Vertical Table Design

§  Horizontal Table

§  Considering performance when mapping inheritance to relation

§  Single Table Inheritance vs. Concrete Table Inheritance vs. Class Table Inheritance

§  Query Tunings

§  Order of Join operations

§  Database Engine Settings

§  The amount of memory is available to the database engine

§  OS Setting

o    Hardware Settings

·         Application Server - Application Tier

o    Data Access Layer

§  Database Provider (Database Middleware)

§  ODBC vs. OLEDB

§  Data Access Method

§  Considering Batch Update

§  Consider using Bulk Copy

§  Connected vs. Disconnected Methods

§  In-Memory Data Structure

§  Array  vs. Collections

o    Business Layer

§  Activity Logging Method

§  Sync Logging vs. Async Logging

§  Business Calculation

§  Workflow engine performance consideration

o    Service Layer

§  Entity Translator

§  Serialization Method

§  Binary vs. SOAP vs. JSON vs. Custom

·         Client - Presentation Tier

o    Service Discovering

o    Control Rendering

o    Data Caching (in Client Proxy)

 

Tags: , , ,
Comments (0)

ITIL Service Support Exam

21 Apr 2010 In: ITIL, Certification

After preparing two weeks, Firday was my exam day! The followings are my mistakes in preparing ITIL Service Support exam:

  • Mistake 1- Focusing on ITIL in isolation. If you are planning to prepare for the exam, I strongly suggest you to think more about your experiences and try to apply your ITIL's knowledge to your organization.
  • Mistake 2-Not Memorizing main actions for each step of ITIL's processes activities.
  • Mistake 3-Not Exploring every statements of the case study about IT departments.
  • Mistake 4-Analyzing the contents in other than IT manager's prespective. Keep in mind that it is a management exam.Try to focus on both management challenges and consideration and IT risks.
Tags: , , ,
Comments (1)

Links

Comming soon...

My Photos

Comming soon ...

About this blog

Blogging some thoughts about technical issues in the following area : Application Architecture, IT Governance, Security, Performance, Patterns and so on.

Archive