JDMurray wrote: » If you will be a programmer writing Web services and Web pages in ASP.NET then yes, you should look into .NET certification. If you are just an admin of Microsoft Web servers then you would look into the MCSE certs for Windows 2003 and the MCITP for Windows 2008 and later.
Bl8ckr0uter wrote: » I will be the admin but I will also help out with development, mainly making sure we are doing things according to best practices.
JDMurray wrote: » You need to get with the people/organization that's defining the best practices that you will be following and ask what they recommend. If you are not an actual programmer then the ASP.NET developer certs are not for you.
Bl8ckr0uter wrote: » That's my point, the developers aren't developing with security in mind and my boss has said, figure out what they need to do (not do it per se) so our new sites can be as secure as possible. Layer 7 on down. I was just wondering how much those certs cover security. I have the ASP.Net 4 book from wrox and it has a few chapters dedicated to security.
JDMurray wrote: » There are no .NET certs specifically for security. You'd be lucky to find that just one of the exams covered only security. Software security starts in the design of the program, not in the coding (implementation). Entire software engineering degrees are based on the concept of software systems security, so I don't think one or two .NET certs will help much. If you have a code base that's critical to the operations of your business, you might look into a professional assessment from a company like Citigal.
JDMurray wrote: » Note that Web sites must be tested both independently of the site's technology, and tested to find vulnerabilities specific to the technology used to implement the site. For example, a poor design of a site's authentication mechanism can exist in any implementation, while an exploit specific to a version of PHP can only used on sites that use PHP. An excellent organization to follow for information on Web site and application security is the Open Web Application Security Project (OWASP).
