Windows SecurityWindows Security
-- Archana Galipalli-- Archana Galipalli
AgendaAgenda
Windows SecurityWindows Security Windows Security and CLRWindows Security and CLR Implementing Windows Security for IISImplementing Windows Security for IIS Configuring Security settingsConfiguring Security settings DEMO- By pass traverse checkingDEMO- By pass traverse checking Token, Principal and Identity objectsToken, Principal and Identity objects DEMO- Accessing TokenDEMO- Accessing Token DEMO- User RolesDEMO- User Roles Runtime security through windowsRuntime security through windows
Why windows security?Why windows security?
To make application more secureTo make application more secure
Configuring the system level settings Configuring the system level settings along with application level settingsalong with application level settings
Vulnerability Trends Vulnerability Trends
Physical
Network
OS
Application
DataBROWSER
Logic/WebSvcsWeb Server
VVeerrttiiccaall
HorizonHorizontaltal
DecreasinDecreasing – g – Leveling Leveling outout
IncreasingIncreasing
Windows Windows security andsecurity and CLR CLR.NET CLR.NET CLR
Ad
min
istr
ato
rA
dm
inis
trat
or
WindowsWindows
Use
rU
ser P
rotected
resou
rces
MMC Snap-insMMC Snap-ins Database ofaccounts
Database ofaccounts
SecurityPolicy
SecurityPolicy
SecurityMonitorSecurityMonitorLogon authenticationLogon authentication
.NETConfiguration
.NETConfiguration AuthorizationAuthorization
AuthenticationAuthentication.NETApplication
.NETApplication
Implementing Windows SecurityImplementing Windows Security
Minimize servicesMinimize services Define the user account for anonymous Define the user account for anonymous
accessaccess Secure the file systemSecure the file system Apply specific registry settingsApply specific registry settings
Securing file systemSecuring file system
wwwRoot
Executables
Scripts
Include
Static
Images
Specific registry settingsSpecific registry settings
SynAttackProtect register value to HKLM\SynAttackProtect register value to HKLM\System\Currentcontrolset\Services\Tcpip\System\Currentcontrolset\Services\Tcpip\Parameters\SynAttackProtectParameters\SynAttackProtect
TCPMaxPortsExhaustedTCPMaxPortsExhausted TCPMaxHalfOpenTCPMaxHalfOpen TCPMaxHalfOpenedRetiredTCPMaxHalfOpenedRetired
Configuring Security settingsConfiguring Security settings
Configuring account policies Configuring account policies • Password policyPassword policy
• Account lock out policyAccount lock out policy
Configuring Local PoliciesConfiguring Local Policies• Audit policyAudit policy
• User Rights AssignmentUser Rights Assignment
• Security OptionsSecurity Options
Walkthrough to configure the Walkthrough to configure the Account policies and Local Account policies and Local
policies….policies….
By pass traverse checkingBy pass traverse checkingWill it workWill it work? ?
DirADirA
DirBDirB
DirCDirC
File.txtFile.txt
User AUser A
User A has no rightsto access folder A
User A has no rightsto access folder A
User A has fullaccess to file
file.txt
User A has fullaccess to file
file.txt
Here goes the answerHere goes the answer!!
By pass traverse checking By pass traverse checking
Is user checked for permissions???Is user checked for permissions???
TokenToken Token unifies data about identityToken unifies data about identity::
User’sUser’s SID SID GroupGroup SID SID PrivilegesPrivileges
Every process has own token representing Every process has own token representing principalprincipal
First process are running on behalf of the First process are running on behalf of the SYSTEM account when computer is SYSTEM account when computer is startedstarted
When user logs on then shell is running in When user logs on then shell is running in user mode under specific principaluser mode under specific principal WinLogon.exe (SYSTEM) WinLogon.exe (SYSTEM) starts user’s shell starts user’s shell
withwith CreateProcessAsUser CreateProcessAsUser method method = => then > then user’s token is propagated to other processesuser’s token is propagated to other processes
What are Principal and Identity What are Principal and Identity objects?objects?
WindowsIdentity: This object encapsulates the WindowsIdentity: This object encapsulates the Windows login user name and the type of Windows login user name and the type of protocol adopted for authentication by Windows protocol adopted for authentication by Windows
GenericIdentity: also stores information about a GenericIdentity: also stores information about a user, but is used when an application needs to user, but is used when an application needs to implement custom logon. implement custom logon.
GenericPrincipal: This object encapsulates the GenericPrincipal: This object encapsulates the identity object and the role identity object and the role
WindowsPrincipal: also stores identity and the WindowsPrincipal: also stores identity and the Windows group membership of the user. Windows group membership of the user.
User Roles User Roles
Acquiring User’s name. Acquiring User’s name. Displaying all the roles in which user Displaying all the roles in which user
is a member.is a member.
Accessing tokenAccessing token
Is token inIs token in WindowsIdentity? WindowsIdentity? Acquiring token from running Acquiring token from running
processprocess User’s name and SID from User’s name and SID from
GetTokenInformationGetTokenInformation
Runtime security through windowsRuntime security through windows
Increase Assembly TrustIncrease Assembly Trust Adjust Zone SecurityAdjust Zone Security Evaluate AssemblyEvaluate Assembly Create Deployment PackageCreate Deployment Package Reset All Policy LevelsReset All Policy Levels
Walkthrough to configure the Walkthrough to configure the runtime security policies….runtime security policies….
ReferencesReferences
Windows Security 2Windows Security 2ndnd Edition by Ben Edition by Ben Smith and Brain Komar.Smith and Brain Komar.
http://pluralsight.com/wiki/default.aspx/Keithttp://pluralsight.com/wiki/default.aspx/Keith.GuideBook/HowToGetATokenForAUser.h.GuideBook/HowToGetATokenForAUser.htmlhtml
http://www.skilldrive.com/WindowsSecIntEhttp://www.skilldrive.com/WindowsSecIntEngOut.zipngOut.zip
Questions?Questions?