Enterprise Library Test Guide - Willy .Net

Testing for Security Best Practices
Testing the Enterprise Library application blocks to see if they conform to security
best practices involves several activities:
●
●
●
●
Establish the security requirements. Security requirements are the goals and
constraints that affect the confidentiality, integrity, and availability of the application
blocks.
Analyze the application block. To analyze an application block, identify such
things as its assets, its entry points, and its dependencies. Create a diagram that
shows the relevant subsystems that make up the application block
Build the threat models. Threat models allow you to systematically identify and
rate the threats that are most likely to affect your applications. By identifying and
rating threats based, you can address threats with appropriate countermeasures in
a logical order, starting with the threats that present the greatest risk.
Perform the security reviews. Apply a set of security rules, known as security
checklists, which constitute the security review. These checklists incorporate the
knowledge acquired by performing the previous steps. The review process should
be an iterative one that frequently occurs.
This chapter focuses on the security review of the Logging Application Block. However,
because the material is intended to show all the aspects of a security review,
there are some examples that other application blocks in the Enterprise Library.
You can adapt the templates and checklists included here to suit your own security
review process.
For more information about what constitutes security best practices, see Additional
Resources.