Enterprise Library Test Guide - Willy .Net

Testing for Security Best Practices 145
Check
Yes
Yes
Yes
Yes
Description
Implement declarative checks for virtual internal methods.
Derived classes can override virtual internal methods. This can change the behavior of
the application block. (Public types do not have internal virtual members so they do not
need these checks.)
Fields should be private. When necessary, expose field values with read-write or readonly
public properties. The following example shows how to use the read-only property
to prevent an attacker from changing the tokens that make up a database connection
string.
public abstract class Database : IInstrumentationEventProvider
{
private static readonly string VALID_USER_ID_TOKENS =
Resources.UserName;
private static readonly string VALID_PASSWORD_TOKENS =
Resources.Password;
(Code access security checks do not apply to fields.)
Use read-only properties where possible.
Review how the application block uses event handlers.
Cryptography Checklist
Table 34 lists the cryptography recommendations.
Table 34: Cryptography Checklist
Check
Yes
Description
Use the .NET Framework-provided cryptography providers instead of custom providers.
The Cryptography Application Block wraps standard .NET providers. Customers can
choose to use a custom provider but this is not a recommended practice.
continued