The Microsoft Security Development Lifecycle (SDL) is the industry-leading software security assurance process

The Microsoft Security Development Lifecycle

Benefits of the Microsoft SDL

• Reducing the number of software vulnerabilitiesThe SDL has played a critical role in embedding security and privacy into Microsoft software and culture, leading to measurable and widely recognized security improvements in flagship products such as Windows Vista and SQL Server.
• Reducing the Total Cost of DevelopmentThe SDL reduces the “Total Cost of Development” by finding and eliminating vulnerabilities early. According to the National Institute of Standards and Technology (NIST), eliminating vulnerabilities in the design stage can cost 30 times less than fixing them post release.

More information: check this out

Web Service optimization

Web Service Summary

• A Web services are used to expose data and functionality in a distributed environment.
  

  WSDL Webservice

• The data exposed can be as simple as a list of product categories or as complex as a multileveled dataset containing a complete customer purchase history.
• Web services are XML based, and distributed applications access them over the Internet using a communications protocol such as Simple Object Access Protocol (SOAP).
• Because the data returned by a Web service is in the form of a standardized XML message, applications residing on different platforms can access the same Web services.
• The primary difference between a Web service application and an ASP.NET application is the interface. An XML Web service relies on help pages and discovery files to interface with its users.
• The user of a Web service is typically another application, so no traditional user interface is necessary.

Web Service optimization

1. Call Web Methods Asynchronously
2. Use ExecuteXmlReader instead of DataSet
3. Use Compression
4. Using SOAP Extensions
5. Use One-Way Method
6. Using Transactions in Web Services
7. SOAP, HTTP GET, HTTP Post
8. Create instances in advance to preload all the referenced assemblies at the very beginning
9. Use pre-authentication
10. Edit IIS custom error messages

Call Web Methods Asynchronously

• Invoking a web-method asynchronously means that an invoked member will perform its work on a different thread and after all the work is done, this member must notify the main thread and, optionally, pass the return values to it.
• This seriously increases performance. If a complicated and slow web method is executed in a separate thread, the main application can proceed performing its tasks without waiting for a web method to complete.
• To call a Web method asynchronously, you have the following choices:Create a new thread and call the method from there.
  Create a delegate object that matches the Web method signature and call it from there.

Use ExecuteXmlReader instead of DataSet

• Using ExecuteXmlReader you can return an XmlDocument object or a string from a Web service.
• You can fully control the response of a WebMethod.

  String sqlString = “SELECT CustomerID, CompanyName FROM Customers For XML AUTO”;

  rdr = command.ExecuteXmlReader();

  rdr.Read();

  while (rdr.ReadState != System.Xml.ReadState.EndOfFile)

  {

  ret += rdr.ReadOuterXml();

  }

Use Compression

• Compress the XML-traffic between the client and the server using the SOAPExtensions mechanism and any compression algorithm.
• You can use a ZIP-compression for you data. There are a lot of open-source compression libraries for C#.
• You can use a free library called SharpZipLib to compress your web methods.
• Adding a compression to your webservice is very easy: include the downloaded project into your solution, reference it in your webservice, and mark your web methods with [CompressionExtension] in the proxy-class code.

Using SOAP Extensions

Pattern Architecture

• Typically SOAP extensions are used to handle data encryption or to compress data to provide better performance. SOAP extensions are often used in conjunction with a custom SOAP header for user authentication.
• You can use custom SOAP extensions to handle unhandled exceptions for Web services.
• For this solution, code need to be added in AfterSerialize stage to check for unhanded SOAP exceptions.
• SOAP extension can be used to override the processing of the SOAP message on the Web server. On the Web server, there are four stages associated with these steps. Each of these stages is repeated twice.1. BeforeSerialize
  2. AfterSerialize
  3. BeforeDeserialize
  4. AfterDeserialize

Use OneWay Method

• In many cases, the Web method you expose through your Web service does not require a response from the client. In cases such as this, you can specify that your Web method is a one-way method by applying the OneWay attribute.
• Applying this attribute makes your method perform more efficiently because it will not wait for a response from the client.
• Your method will only process input parameters and cannot be used to return referenced values or throw exceptions.
• In this caller does not get anything in return so it is called as one-way communication.

  [SoapDocumentMethod (OneWay=true)]

  [WebMethod]

  public string TestMethod()

  { }

Using Transactions in Web Services

• You can declare the Web service’s transactional behaviour by setting the TransactionOption property of the WebMethod attribute applied to the Web service method.
• XML Web service methods can only participate as the root object in a transaction, due to the stateless nature of the HTTP protocol.Example:

  using System.EnterpriseServices;

  public class Bank : WebService

  {

  [WebMethod(TransactionOption = TransactionOption.RequiresNew)]

  public int DeleteAuthor(string lastName)

  {

  //ContextUtil.SetAbort();

  }

  }

SOAP, HTTP GET, HTTP Post

• By default, in .NET Framework 1.0, all three protocols are enabled. By default, in .NET Framework 1.1, HTTP GET and HTTP POST are both disabled. This is for security reasons.

Only HTTP POST and SOAP care about the Content-Type because they send the data in the body of the HTTP request. The HTTP GET protocol does not really care about the Content-Type because all of the parameters are packaged into the query string.

Create instances in advance to preload all the referenced assemblies at the beginning

Everybody notices that a first call to a web service takes more time to execute than the subsequent calls.
Why is that? Try to run your application in Debug mode and look at the “Output” window of Visual Studio.

• Once a web method is invoked, the application loads a number of libraries like System.Web.dll, System.Web.Services.dll, System.XML.dll etc. And maybe other assemblies of your own, which describe some classes you, use to work with your web service.
• This loading takes time, of course. So create an instance of a web service in advance, when your application starts.
• This loads all the needed libraries in memory and saves time.

Using pre-authentication

• Any call to a webservice’s method generates at least one 401 error (and if you use “integrated Windows authentication”, then there might be two or three 401 errors!). To avoid this, set PreAuthenticate to true.
• But keep in mind that not all authentication methods used by the hosting web servers support pre-authentication if your hosting IIS-server uses “Windows Integrated Authentication”, pre-authentication is not possible.
• To speed-up the web service call, use the “basic” authentication scheme. Use it only with SSL-protected webservices and websites.

Edit IIS custom error messages

• When something goes wrong, a web server displays an error message. The htm-files containing these messages are located in the c:\WINDOWS\Help\iisHelp\common\ server folder (if not, look at your IIS settings).
• Edit these files to minimize traffic! Get rid of styles, tables, and other “beauties”.
• There’ always a 401 error when a web-service is accessed. Even if PreAuthenticate is set to true, the 401-error will be generated when a Web Service is accessed for the first time. So minimize the 401-files.
• Error 401.2 – Unauthorized: Access is denied due to server configuration.
• IIS’s default 401-2.htm is 5 kilobytes, but you can change it and it will be only 73 bytes long.

Copyright:  Devanand Laroiya

Image from: Liberidu IBM SOA Architecture Center