Enterprise Library Test Guide - Willy .Net
Enterprise Library Test Guide - Willy .Net
Enterprise Library Test Guide - Willy .Net
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
<strong>Test</strong>ing for Security Best Practices 143<br />
Table 31: General Code Review Checklist<br />
Check<br />
Yes<br />
Yes<br />
Yes<br />
Description<br />
Clearly document potential threats and log them in a bug tracking database. (Threats<br />
are dependent on the specific scenario and application block.)<br />
Develop code that is based on the .NET Framework design guidelines. For more information,<br />
see Design <strong>Guide</strong>lines for Class <strong>Library</strong> Developers on MSDN.<br />
Run the FxCop analysis tool on assemblies and address all security warnings.<br />
Managed Code Review Checklists<br />
The checklists that are in the managed code category are:<br />
●<br />
●<br />
●<br />
●<br />
●<br />
●<br />
●<br />
●<br />
●<br />
●<br />
Assembly-level checklist<br />
Class-level checklist<br />
Cryptography checklist<br />
Secrets checklist<br />
Exception management checklist<br />
Delegates checklist<br />
Serialization checklist<br />
Threading checklist<br />
Reflection checklist<br />
Unmanaged code access checklist<br />
Assembly-level Checklist<br />
Table 32 lists the assembly-level recommendations.<br />
Table 32: Assembly-level Checklist<br />
Check<br />
No<br />
Yes<br />
Description<br />
Assemblies can have a strong name to guarantee that no one has tampered with them.<br />
The threat model specifies that customers should sign assemblies for this purpose.<br />
However, because the <strong>Enterprise</strong> <strong>Library</strong> ships as source code, the assemblies do not<br />
have strong names.<br />
Consider delay signing the assemblies to reduce exposure of the private key that is<br />
used in the strong naming and signing processes.<br />
continued
Change language