Date post: | 03-Jan-2016 |
Category: |
Documents |
Upload: | lee-alexander |
View: | 221 times |
Download: | 2 times |
Securing Your ASP.NET Securing Your ASP.NET ApplicationApplication
Presented by:Presented by:Rob BagbyRob BagbyDeveloper EvangelistDeveloper [email protected]@microsoft.com (email)(email)http://www.robbagby.comhttp://www.robbagby.com (blog)(blog)
Security Overview / Basics
ASP.NET Security Architecture
Authentication
Authorization
Input Validation
Database
Sensitive Data
Session AgendaSession Agenda
Defense-In-Depth Security – The concept that many layers of security is better than one layer.
Security OverviewSecurity Overview
Threat ModelingThreat Modeling
Structured approach to:Structured approach to:Evaluate security threatsEvaluate security threats
Identify countermeasuresIdentify countermeasures
DREAD helps rate riskDREAD helps rate riskDamage potentialDamage potential
ReproducibilityReproducibility
ExploitabilityExploitability
Affected usersAffected users
DiscoverabilityDiscoverability
More information in MSDN Patterns and PracticesMore information in MSDN Patterns and Practiceshttp://msdn.microsoft.com/library/en-us/dnnetsec/html/ThreatCouhttp://msdn.microsoft.com/library/en-us/dnnetsec/html/ThreatCounter.aspnter.asp
Threat Modeling ProcessThreat Modeling Process
1. Identify Assets
2. Create an Architectural Overview
3. Decompose the Application
4. Identify the Threats
5. Document the Threats
6. Rate the Threats
Session AgendaSession Agenda
Security Overview / Basics
ASP.NET Security Architecture
Authentication
Authorization
Input Validation
Database
Sensitive Data
Gatekeepers – The authorization points within an ASP.NET application that are provided by:
IISASP.NET
IISPermits requests from users that it can authenticate (with anonymous turned off)Uses NTFS permissions to perform access control
ASP.NET Architecture - ASP.NET Architecture - GatekeepersGatekeepers
ASP.NET – has 2 gatekeepers
UrlAuthorizationModuleConfigure <authorization> elements in Web.Config to configure accessBased on IPrincipal (stored in HttpContext.User)
FileAuthorizationModuleFor file types mapped to the ASP.NET ISAPI ext.Access checks done using the authenticated users token
Could be the anonymous account
ASP.NET Architecture - ASP.NET Architecture - GatekeepersGatekeepers
Declarative
[PrincipalPermission(SecurityAction.Demand, Role=@"DomainName\
WindowsGroup)]
ImperativePrincipalPermission permCheck = new PrincipalPermission( null,
@"DomainName\ WindowsGroup");
permCheck.Demand();
ASP.NET Architecture ASP.NET Architecture (Principal Permission Demands)(Principal Permission Demands)
Session AgendaSession Agenda
Security Overview / Basics
ASP.NET Security Architecture
Authentication
Authorization
Input Validation
Database
Sensitive Data
The process by which a user is uniquely identified, given his/her credentials.
Authentication Options
Windows w/ impersonation
Windows w/o impersonation
Forms
Passport
AuthenticationAuthentication
Operating system authenticates user
Requires valid windows account
Transparent access to resources
WindowsIdentityWindowsIdentity widentity = WindowsIdentity.GetCurrent();
IIdentity iidentity = WindowsIdentity.GetCurrent();
Authentication - WindowsAuthentication - Windows(Overview)(Overview)
Configuration<authentication mode=“Windows” />
<identity impersonate=“true” />
AdvantagesACLs for Resources accessed by your app.Flow caller’s identity to middle tier
DisadvantagesReduced scalability – database poolingRequires windows account for each userIncreased administration
Authentication - WindowsAuthentication - Windows(w/ Impersonation)(w/ Impersonation)
Configuration<authentication mode=“Windows” />
<identity impersonate=“false” /> (or no identity ele.)
AdvantagesACLs for Client Requested ResourcesURL Authorization<authorization>
<deny user=“DomainName\UserName” />
<allow roles=“DomainName\WindowsgroupName” />
</authorization>
DisadvantagesRequires windows account for each userIncreased administration
Authentication - WindowsAuthentication - Windows(w/o Impersonation)(w/o Impersonation)
Configuration<authentication mode=“Forms”>
<forms loginUrl=“login.aspx” name=“AuthCookie” timeout=“60” path=“/” />
</authentication>
AdvantagesNo Windows accounts requiredFirewall friendly
DisadvantagesYou have to implement / write
Authentication - FormsAuthentication - Forms
Configuration<authentication mode=“Passport” />
AdvantagesSingle sign-on
DisadvantagesNon-trivial to implement
Authentication - PassportAuthentication - Passport
Session AgendaSession Agenda
Security Overview / Basics
ASP.NET Security Architecture
Authentication
Authorization
Input Validation
Database
Sensitive Data
The Process By which The System Validates That The Authenticated User Has Access To Resources Or Has Privileges To Perform Certain Operations.
Options Depend upon Authentication type
Windows w/ impersonation
Windows w/o impersonation
Forms
Passport
AuthorizationAuthorization
Behaviors
ACLsClient Requested Resources: Original Caller’s tokenResources Accessed by Application: Original Caller’s token
URL Authorization: Original Caller’s Group or User<authorization>
<deny user=“DomainName\UserName” />
<allow roles=“DomainName\WindowsgroupName” />
</authorization>
Authorization - WindowsAuthorization - Windows(w/ Impersonation)(w/ Impersonation)
Behaviors
ACLsClient Requested Resources: Original Caller’s tokenResources Accessed by Application: ASP.NET process identity
URL Authorization: Original Caller’s Group or User<authorization>
<deny user=“DomainName\UserName” />
<allow roles=“DomainName\WindowsgroupName” />
</authorization>
Authorization - WindowsAuthorization - Windows(w/o Impersonation)(w/o Impersonation)
BehaviorsACLs
Client Requested Resources: ACLs must allow read access to anonymous Internet user accountFile Authorization not availableResources Accessed by Application: ASP.NET process identity
URL Authorization: Determined by custom data store. Sql example:<authorization>
<deny user=“?” /><allow roles=“RoleName, RoleName1” />
</authorization>
Authorization - FormsAuthorization - Forms
.NET Role-Based OptionsDeclarative Demands With PrincipalPermissionAttribute (1 Role)
[PrincipalPermissionAttribute(SecurityAction.Demand, Role=“MyRole”)]
Imperative Demands Using PrincipalPermission Object (Multiple)
public void MyMethod { PrincipalPermission perm = New PrincipalPermission(null, “MyRole”); perm.Demand(); }
Role Checks With IsInRole (Multiple)Principal.IsInRole(“MyRole”);
Custom Authentication Role Checks
string[] roles = new string[] {“MyRole”, “MyRole1”};
IPrincipal principal = new GenericPrincipal(identity, roles);
principal.IsInRole(“MyRole”);
Authorization cont.Authorization cont.(Role-Based)(Role-Based)
Defense-In-Depth Approach
Granular Roles
Declarative Demands, Where Possible
Use IsInRole If You Need to Check > 1 Role Membership
Authorization cont.Authorization cont.(Guidelines)(Guidelines)
Session AgendaSession Agenda
Security Overview / Basics
ASP.NET Security Architecture
Authentication
Authorization
Input Validation
Database
Sensitive Data
Assume all input is malicious
Centralize your approach
Do not rely on client-side validation
Be careful with canonicalization issues
Constrain, reject, and sanitize your input
Input ValidationInput Validation
Session AgendaSession Agenda
Security Overview / Basics
ASP.NET Security Architecture
Authentication
Authorization
Input Validation
Database
Sensitive Data
Use Stored ProceduresGrant Access Only To Stored ProceduresParameterize Queries, When SPs Not Possible
Use Least-Privileged Account Approach
Protect Connection Strings As Secrets
Hash Passwords
Encrypt Sensitive Data
DatabaseDatabase
Session AgendaSession Agenda
Security Overview / Basics
ASP.NET Security Architecture
Authentication
Authorization
Input Validation
Database
Sensitive Data
Hashing – Practically Impossible To Reverse
Encryption – Can Only Decrypt With Encryption Key
DPAPI – Data Protection API
Sensitive DataSensitive Data
Sensitive Data Cont.Sensitive Data Cont.
I want to… Recommendation Advantages Limitations
Store a user password securely
Salt + SHA1 (One-way hash)
Prepend random salt to the passwords before hashing to defend against off-line dictionary attacks.
No keys to manage.
Identical input yields identical hash values.
Must store a salt to ensure unique cipher text for identical values.
Sensitive Data Cont.Sensitive Data Cont.
I want to… Recommendation Advantages Limitations
Store a user password securely
Salt + SHA1 (One-way hash)
Prepend random salt to the passwords before hashing to defend against off-line dictionary attacks.
No keys to manage.
Identical input yields identical hash values.
Must store a salt to ensure unique cipher text for identical values.
Protect local user data
DPAPI (Encryption using keys derived from user credentials)
DPAPI manages keys on behalf of the application.
Data can’t be decrypted by other users, or on other machines.
Sensitive Data Cont.Sensitive Data Cont.
I want to… Recommendation Advantages Limitations
Store a user password securely
Salt + SHA1 (One-way hash)
Prepend random salt to the passwords before hashing to defend against off-line dictionary attacks.
No keys to manage.
Identical input yields identical hash values.
Must store a salt to ensure unique cipher text for identical values.
Protect local user data
DPAPI (Encryption using keys derived from user credentials)
DPAPI manages keys on behalf of the application.
Data can’t be decrypted by other users, or on other machines.
Encrypt data that will need to decrypted later
Symmetric encryption algorithms (e.g. Rijndael)
Flexible: data can be decrypted by other apps / machines that have the key.
Application must manage keys and transmit them securely.
Wrap-up & Questions …Wrap-up & Questions …
Rob BagbyRob BagbyDeveloper EvangelistDeveloper [email protected]@microsoft.com (email)(email)http://www.robbagby.comhttp://www.robbagby.com (blog)(blog)