What are the best security practices for having a really secured site with asp.net mvc?

Question

I searched all over the internet trying to get a guidance about the security practices for a really secured site like an online banking site and didn't find any. My interest is to know what practices you are using in following areas:

1. Communication: definitely using SSL ... any extra tips to protect against "man-in-the-middle" attacks.
2. Authentication: username + password + capatcha + time limits + enforce regular changes.
3. Navigation between pages: Is there such thing ?
4. Prevent XSS and XSRF: already in the platform.
5. Encrypt sensitive data on client and server: like what exactly ? should there be sensitive data on the client ?
6. Fine tuned authorization: show/hide + execute commands + permissions.
7. Auditing ? what ? and how this differs from logging.
8. Page level security: prevent manipulation in page content (Do we actually need this?)

And how to detect penetration attempts ? Monitor IPs, Lock certain accounts ... ? Is there a way to test or simulate threats ?

Answer 1

I would start with PCI-DSS guidance as a baseline for protecting the data.

PCI-DSS is the Payment Card Industry Data Security Standard. It's the industries first attempt to lay down guidelines for protecting data around the banking area. The guidelines are specifically for cardholder data, but are a great resource for protection of data in general. PCI requirements include yearly onsite audits, and quarterly network scans.

Another good resource is OWASP which offers guidance on security of web applications in general

OWASP goes into a lot of detail about how to perform threat modelling, test for (and correct) common vulnerabilities. For the quick start head to the OWASP Top Ten