Security Ramifications for IIS Applications

Securing Web sites is one of the most critical issues for Web developers. It is also one of the most potentially confusing. A secure system requires careful planning, and Web site administrators and programmers must have a clear understanding of their options for securing their site. In addition, they need to understand how all of the various security sub-systems interact. This section provides an overview of the technologies used by IIS to create a secure environment for application development.

This section includes:

• ASP Session ID Encryption and Session Security: An overview of ASP Session security.
• User Authentication Methods: The three types of client authentication.
• Additional Security Considerations: Managing security and system resources.

Security and permission problems account for the majority of ASP issues. In order to avoid these problems, ASP developers must have a firm grasp of IIS authentication and controlling access to pages using NTFS file permissions. For more information about securing your ASP application, see Securing an ASP Application.