PCI Compliance and Web Applications

What do the Payment Card Industry (PCI) compliance terms mean to your web-application?

There are six major categories, broken down to 12 requirements:

Build and Maintain a Secure Network

Requirement 1: Install and maintain a firewall configuration to protect cardholder data
Requirement 2: Do not use vendor-supplied defaults for system passwords and other security parameters

Protect Cardholder Data

Requirement 3: Protect stored cardholder data
Requirement 4: Encrypt transmission of cardholder data across open, public networks

Maintain a Vulnerability Management Program

Requirement 5: Use and regularly update anti-virus software
Requirement 6: Develop and maintain secure systems and applications

Implement Strong Access Control Measures

Requirement 7: Restrict access to cardholder data by business need-to-know
Requirement 8: Assign a unique ID to each person with computer access
Requirement 9: Restrict physical access to cardholder data

Regularly Monitor and Test Networks

Requirement 10: Track and monitor all access to network resources and cardholder data
Requirement 11: Regularly test security systems and processes

Maintain an Information Security Policy

Requirement 12: Maintain a policy that addresses information security

from: https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml

Microsoft’s Deep Zoom – Hard Rock Cafe’s Memorabilia Collection

If you have never experienced Microsoft’s Deep Zoom technology then I strongly urge you to hop on over to “http://memorabilia.hardrock.com/” and follow my instructions below:

First zoom into Paul McCartney’s letter to Sgt. Buddy Dresner.

Next zoom in to the envelope

Next zoom in to the stamp on the left

Zoom in to the picture of Hard Rock in New York

Now zoom in to the billboard in the picture – highlighted by the green circle

Keep zooming in to the frame of the Beatles bobble head dolls.

Very, very cool.

Here is a video:

Want to check it out on your iPhone….

Here are the instructions: Permanent Link to Hard Rock Memorabilia in Seadragon Mobile

Scrum on a page

From a Neudesic seminar “Introduction to Agile”

http://www.neudesic.com/insight/Presentation/Pages/PW20090326.aspx

Project Natal - Wii evolved

This is very, very cool. Project Natal is currently a research project at Microsoft’s XBox 360 group. Its awesome because it takes gaming from what we get from Wii to a totally new level. You get to interact with the game without any controls and the games have the ability to respond to all your natural body motions. The games even have the ability to respond to your voice.

The following video is awesome and a must see…..

Project Natal for XBox 360 – this one is almost like an ad and it shows what all is possible while interacting with Project Natal

Also check out starting from about 80 minutes into the following E3 presentation, where Microsoft showed off the technology for the first time to the gaming community. http://e3.gamespot.com/press-conference/microsoft-e3/

More info:

http://www.techflash.com/microsoft/Microsofts_Project_Natal_Sensor-based_Xbox_360_control_46647882.htm

Microsoft’s site: http://www.xbox.com/en-US/live/projectnatal/

Scrum cartoon – story of the pig and the chicken

This story was referenced in a TFS seminar today.

Here is an easy definition of the Chickens versus Pigs.

A Pig is someone who has skin in the game. Pig roles are considered core team members.

A Chicken is someone who has something to gain by the Pigs performing, but in the end, really do not contribute day to day to “getting things done.” Their “eggs” are a renewable resource, and numerous.

Read more at The Classic Story of the Pig and Chicken.

Spotted at a TFS Event today

Saw this in a presentation at the TFS Big Event at Denver today….

Coding standard – naming of UI elements

Prefixes that I use for UI elements (I find that if I dont have this list hanging around my monitor, I very soon start making up my own prefixes – especially for those controls that I dont use often: e.g. PlaceHolder)

Control	Prefix
Label	lbl
TextBox	txt
DataGrid	dtg
Button	btn
ImageButton	imb
Hyperlink	hlk
DropDownList	ddl
ListBox	lst
DataList	dtl
Repeater	rep
Checkbox	chk
CheckBoxList	cbl
RadioButton	rdo
RadioButtonList	rbl
Image	img
Panel	pnl
PlaceHolder	phd
Table	tbl
Validators	val

Console.ReadLine and buffer size limits

If you have ever tried entering a large body of text at a Windows DOS prompt that was created using .Net’s Console.ReadLine() command you might have realized that you cannot type in more than 256 characters (254 characters to be precise as the last 2 would be used reserved for the CR and LF characters).

Here is a simple way of getting around this limit in .Net (C# code sample)

My first swing at this did not work and seemed to be ignoring the buffer size in READLINE_BUFFER_SIZE. Below is my 2nd go at it, which fixes the buffer size issue:

private static string ReadLine()
    {
        Stream inputStream = Console.OpenStandardInput(READLINE_BUFFER_SIZE);
        byte[] bytes = new byte[READLINE_BUFFER_SIZE];
        int outputLength = inputStream.Read(bytes, 0, READLINE_BUFFER_SIZE);
        //Console.WriteLine(outputLength);
        char[] chars = Encoding.UTF7.GetChars(bytes, 0, outputLength);
        return new string(chars);
    }

Below is my first iteration code that reads only 1024 bytes of data, regardless of READLINE_BUFFER_SIZE.

const int READLINE_BUFFER_SIZE = 1024;
private static string RL()
{
   Stream inputStream = Console.OpenStandardInput(READLINE_BUFFER_SIZE);
   Console.SetIn(new StreamReader(inputStream));
   return Console.ReadLine();
}

log4net – configuration via a separate file

Typically log4net is configured by inserting the log4net element into the application configuration file. Another method that can provide more flexibility is to use a separate config file used to store only log4net settings. Here is how to do that:

1. Move the log4net element from the web.config file to a separate file (I call it log4net.config). The file should begin and end with the log4net element. Here is a sample

<log4net>
  <appender name="RollingLogFileAppender" type="log4net.Appender.RollingFileAppender">
    <file value="logs//Gateway.log"/>
    <appendToFile value="true"/>
    <datePattern value="yyyyMMdd"/>
    <rollingStyle value="Date"/>
    <MaxSizeRollBackups value="180" />
    <filter type="log4net.Filter.LevelRangeFilter">
      <acceptOnMatch value="true"/>
      <levelMin value="DEBUG"/>
      <levelMax value="FATAL"/>
    </filter>
    <layout type="log4net.Layout.PatternLayout">
      <conversionPattern value="%-5p %-25d thr:%-5t %9rms %c{1},%M: %m%n"/>
    </layout>
  </appender>
  <root>
    <appender-ref ref="RollingLogFileAppender" />
  </root>
</log4net>

2. Make sure that you have the following element in the web.config file

<configuration>
  <configSections>
    <section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler, log4net"
             requirePermission="false"/>
  </configSections>
.............

3. In the Global.asax file add the following code:

void Application_Start(object sender, EventArgs e) 
{
    System.IO.FileInfo fi = new System.IO.FileInfo(Server.MapPath("~/log4net.config"));
    if (fi != null && fi.Exists)
    {
        // Code that runs on application startup
        log4net.Config.XmlConfigurator.Configure(fi);
    }
}

4. Use the following code to instantiate Log4Net as a member variable of a class that will be performing logging:

private static readonly ILog log = LogManager.GetLogger(MethodBase.GetCurrentMethod().DeclaringType);

5. Finally use the following code to log information:

log.Debug("Hello World");
log.Error("Hello Jupiter");

Using & (ampersand) in .net configuration files

You cannot use the & symbol in the application configuration files (web.config and app.config). For your application to work replace the & symbol with &