Securing ASP.Net Website?

Question

How to secure ASP.Net Website ( Commercial Application ) using SQL 2008 ? We are working on securing both on Front ( Web App) and Back End ( Protecting from SQL Injection ) ..! Other than Secured Protocol .. from programming end , what are the security measurements we would consider ?

Answer 1

Using https is not a silver bullet for creating secure applications!

I recommend getting a copy of Beginning ASP.NET Security. It's got chapters on everything you'll need for security, including Cross-Site Scripting, input validation, SQL injection, cryptography and AJAX.

Answer 2

The Developer Highway Code is an excellent checklist which I would recommend you reading.

Answer 3

This is good reference on MSDN:

How To: Protect From SQL Injection in ASP.NET

Microsoft Patterns & Practices is a good starting point.