.Net Framework Security By: LaMacchia, Lange, Lyons, Martin, Price Publisher: Addison Wesley  April 2002

Review by Andrew Novick

Summary: The book covers all aspects of security in the Microsoft .Net Framework.  Most importantly it covers Code Access Security, authentication in the Web context and cryptography.

This is a book that had to be written and had to be written now.  The information it contains is important to system designers who are designing systems, mostly Internet based systems, based on the .Net Framework.  While there is some coverage of security topics in the .Net documentation, it doesn’t begin to give any perspective on the subject provided by this book.  However, it’s a dry book on a dry subject.  Read it only if you really have to.

That much said obvious sacrifices had to be made to get this book out now, not later.  The five authors have inconsistent styles.   The introductory chapters are very abstract with hardly an example to show how the abstract concepts are realized.  Later chapters are more down and dirty and, particularly in the area of cryptography, get into some pretty low level examples of how to put it into practice.

After giving an overview of the .Net Framework the book tackles Code Access Security in an abstract way. Code Access Security (CAS) is .Net’s mechanism for fine-grained control over the permissions for executing managed code. Using CAS, the .Net runtime applies permissions to code based on the identity of the code, not the user running the code.   The application of permission is based on policies that can be set by system administrators.  In this way code downloaded from the Internet and not digitally signed can be given different rights than code digitally signed by a trusted source such as an in-house development team and run from the hard disk.  These permissions can control access to directories, files, memory, other code or other resources.  CAS rights checking is in addition to the rights checking performed by the operating system based on the user’s identity.

ASP.Net and Web security are tackled next.   The new methods of authentication available in .Net are given their due.   New topics like Forms based authentication as well as old topics like using SSL are covered.

There’s a section on administering .Net security.  It goes into the setting the files that define the policy at the enterprise, machine and user levels.  These files are XML configuration files that have generally replaced the use of the registry and ini files in .Net.  A moderate amount of coverage is given to the GUI tools.

The final sections of the book are a more detailed look at some security tasks from the developer’s prospective.  Here we get some of the details about how to create .Net assemblies that implement CAS.  There are also more detailed chapters on ASP.Net security and cryptography.  These are the chapters that give the most details.  They’re a start, but they can’t go very deep.

The .Net Framework has some very promising although complicated new capabilities to let administrators and developers create a more secure environment for code.  Someday soon this book will be supplanted by several books, each on one or more aspects of what is covered here.  Each book will be more thorough on the particular subject.  For now, it’s the only game in town.  So if you really need to know the ins and outs of .Net security now, go ahead, read this book.  If you’re ramping up more slowly and can wait, then wait.