Cert-In Training Program For Government, Psus and Critical Sector Oragnizations

Secure Coding in .
NET
Cert-In Training Program for
Government, PSUs and Critical Sector
Oragnizations
In Collaboration With: Data Security Council of India
Under the Project: Cyber-Security Awareness

Program
Educated By: Microsoft Corporation India Pvt Ltd

Agenda
• Secure Development Lifecycle - IT

• Authentication
• Authorization
• Input Validation
• Data Handling
• CAT.NET Tool
SDL-IT – Security Development
Life Cycle
• Ensures security & privacy standards are
met by Line of Business applications
• ACE Team – Application Consulting &
Engineering
• Provides security, privacy & performance
services
• Why ACE Secure Application
Development?
SDL-IT: The process
• Works in the early phases of the SDLC

• Each new or revised application is
evaluated for its Security and Privacy
impact
• Based on its impact and release profiles,
the application release is subject to
various levels of assessment and
enforcement
9/23/2010 4
SDL-IT Tasks: Envisioning Phase
Envisioning Design Build Stabilizing Deploying Production Retire
• Enter Application info into inventory system
• Complete the Impact Assessment

• Classify your application’s Security impact value
• The results of the Impact Assessment questionnaire drive impact
levels.
9/23/2010 5
SDL-IT Tasks: Design Phase
• Security
• Complete a Threat Model
• Review Security Mandatory Items Checklist
9/23/2010 6
Threat Model
• Threat Analysis & Modeling (TAM) Tool

• Objective
• Threat modeling provides a consistent methodology
for objectively evaluating threats to applications
• Review application design to verify compliance with
security standards and best practices
• Verify application meets application principles
9/23/2010 7
SDL-IT Tasks: Stabilizing Phase
• Security
• Conduct Pre-Production Limited Assessment, as a “Best
Practice”
• Microsoft Baseline Security Analyzer (MBSA) + Partial manual
checks
• Full manual server checks
• Security Team conducts Security Comprehensive Assessment
• Candidates are applications where:
• Security Impact = Medium / High
• Security Release = Yes
9/23/2010 8
SDL-IT Tasks: Deploying Phase
• Security
• Conduct Production Limited Assessment, as
a “Best Practice”
• Update inventory application:
• Actual release date
• Version status to “In Production”
9/23/2010 9
SDL-IT Tasks: Production Phase
• If all SDL-IT tasks are completed,

…then you’re good to go!
• If not…
… establish an exception process
9/23/2010 10
SDL-IT Tasks: Retire Phase
• Update inventory application:

• Actual retirement date
• Version status to “Retired”
9/23/2010 11
Fundamentals
Authentication
• Who are you?

• Authentication is the process where an
entity proves the identity of another entity,
typically through credentials, such as a
user name and password.
Authentication Paradigms
• What you know?

• What you have?
• What you are?
16
Fiddler Lab
9/23/2010 17
Secure Sockets Layer
• SSL is used for

• Confidentiality
• Integrity
• Authentication using digital certificates
• Server Authentication
• Optional Client Authentication
18
Authentication Best Practices
• Network eavesdropping
• Use authentication mechanisms that do not
transmit the password over the network such
as Kerberos protocol
• Make sure passwords are encrypted (if you
must transmit passwords over the network)
for example with SSL
19
• Brute force attacks and Dictionary attacks

• Use strong passwords that are complex, are
not regular words, and contain a mixture of
upper case, lower case, numeric, and special
characters
• Store non-reversible password hashes in the
user store. Also combine a salt value (a
cryptographically strong random number)
with the password hash
20
• Cookie Replay Attacks

• Use an encrypted communication channel
provided by SSL whenever an authentication
cookie is transmitted.
• Use a cookie timeout to a value that forces
authentication after a relatively short time
interval
• Do not persist authentication cookies
21
Authorization
• What can you do?

• Authorization is how your application
provides access controls for resources
and operations.
22
Authorization Issues
• Direct Object Reference (Normal execution)
• Direct Object Reference (What attacker does)
• Direct Object Reference
• Unique identifier is used to retrieve and
update data for an object. This unique
identifier is an incrementing integer (or easily
available).
• No explicit authorization check is performed to
ensure current user has access to the object.
Authorization Lab
9/23/2010 26
• Disabling Controls in the Web site to
enforce authorization (Normal execution)
• Disabling Controls in the Web site to
enforce authorization (What attacker does)
• Disabling HTML text boxes, buttons in only
a visual indication, not a security control
• Need to perform explicit authorization
checks on the server side
• Forceful browsing
• No authorization checks implemented on
pages
• Security based on the fact that user does not
know the URL
• Missing authorization in web services in
multi- tier applications
Web Server Web Server SQL Server
(Website) (Web service) (Database)

• Countermeasures:-
• Perform server side authorization
• Use a platform provided authorization
mechanism
• URL Authorization
• Declarative and Imperative checks
• Implement authorization controls in middle
tiers
Input Handling
• How do you know that the input that your

application receives is valid and safe?
Input validation refers to how your
application filters, scrubs, or rejects input
before additional processing.
Input Validation
• Principle of Exclusions
• Principle of Inclusions
Consequences of Inappropriate
Input Handling
• Lead to a realization of various attack
patterns
• Cross-Site Scripting (XSS)
• One-Click Attacks
• SQL Injection
• LDAP Injection
• Response Splitting
• Unsafe Filename Handling
Consequences of Inappropriate
Input Handling cont.
• Canonicalization issues
• Buffer overflow or arithmetic errors (Memory
Management issues)
• Format String
• Integer Overflow
• Application Layer Denial of Service
Protection
What is Cross-Site Scripting?
• A technique that allows attackers to:

• Appear to rewrite the text of your web site
• Abuse the user’s trust in your website to…
• Steal Web session information and cookies
• Hijack client sessions
• Potentially access the client computer
XSS Attack Patterns
• XSS attacks can be classified in two categories:
• Persistent
Generally affects web-based applications (e.g.,
message forums) which persist user-supplied data
for later display
• Non-Persistent
Generally affects web-based applications which echo
data back to the client who supplied it
• DOM Based
Defending Against Cross-Site
Scripting Attacks
• Do not:
• Trust user input
• Echo client-supplied data without encoding
• Store secret information in cookies
• Do:
• Take advantage of ASP.NET’s RequestValidation
• Consider Anti-XSS for data encoding
• Use the HttpOnly cookie option
Defending Against XSS (cont.)
• Server.HtmlEncode() doesn’t always

protect your app…
• It only encodes < > & “
• Use Anti-XSS(properly implemented)
• EncodeHtml()
• EncodeHtmlAttribute()
• EncodeVbs()
• EncodeJs()
• AsUrl()
Cross-site Scripting Lab
9/23/2010 41
What is SQL Injection?
• SQL injection is:
• The process supplying carefully crafted input to alter (or create)
SQL statements
• Can be used by malicious users to compromise confidentiality,
integrity or availability of your application:
• Probe databases
• Bypass authorization
• Execute multiple SQL statements
• Call built-in stored procedures
Defending Against SQL
Injection
• Abandon Dynamic SQL
• Use stored procedures or SQL parameterized
queries to access data
• Can have SQL Injection in stored procedures
• Sanitize all input
• Consider all input harmful until proven otherwise –
test for valid data and reject everything else
• Run with least privilege
• Never execute as “sa”
• Restrict access to built-in stored procedures
• Do not display errors directly from database.
SQL Injection Lab
9/23/2010 44
What is One-Click Attack?
• Site offers persistent sign-in option

• Cookies or Windows Authentication
• Victim user navigates to (or opens) an
HTML page – perhaps a “once in a
lifetime offer”
• One or more actions are carried out using
the trust of the victim user which is
completely unsuspecting to that user
Defending Against One-Click
Attack
• Browser’s cross-frame security limits this to a “write-
only” attack
• Concept for defense: require a data element in the
request which the attacker can’t supply
• (Overkill) Re-authenticate the user
• Can ask for confirmation
• Check Referrer field
• document.location or window.open() don’t
post Referrer
Attack (cont.)
• Classic ASP
• Generate a unique session ID once user
authenticates, encrypt it and bind it to each
response sent to user
• In .Net 1.1 & 2.0 use ViewStateUserKey
• Value assigned to it must be unique to the
current user
• This value is used as a factor in the
ViewState MAC
Attacks
override protected void OnInit(EventArgs e)
{
// ...
ViewStateUserKey = User.Identity.Name;
// ...
}
One Click Attack Lab
9/23/2010 49
CAT.NET Demo
© 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.

Cert-In Training Program For Government, Psus and Critical Sector Oragnizations

Uploaded by

Copyright:

Available Formats

Cert-In Training Program For Government, Psus and Critical Sector Oragnizations

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Cert-In Training Program For Government, Psus and Critical Sector Oragnizations

Uploaded by

Copyright:

Available Formats

Secure Coding in .

Under the Project: Cyber-Security Awareness

Educated By: Microsoft Corporation India Pvt Ltd

• Secure Development Lifecycle - IT

• Works in the early phases of the SDLC

• Enter Application info into inventory system

• Complete the Impact Assessment

• Threat Analysis & Modeling (TAM) Tool

• If all SDL-IT tasks are completed,

… establish an exception process

• Update inventory application:

• Who are you?

• What you know?

• SSL is used for

• Brute force attacks and Dictionary attacks

• Cookie Replay Attacks

• What can you do?

Web Server Web Server SQL Server

(Website) (Web service) (Database)

• How do you know that the input that your

• A technique that allows attackers to:

• Server.HtmlEncode() doesn’t always

• Site offers persistent sign-in option

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.