Windows Security -- Archana Galipalli

Agenda  Windows Security  Windows Security and CLR  Implementing Windows Security for IIS  Configuring Security settings  DEMO- By pass traverse checking  Token, Principal and Identity objects  DEMO- Accessing Token  DEMO- User Roles  Runtime security through windows

Why windows security?  To make application more secure  Configuring the system level settings along with application level settings

Vulnerability Trends Physical Network OS Application VerticalVerticalVerticalVertical Horizontal Decreasing – Leveling out Increasing

Windows security and CLR.NET CLR Administrator Windows User Protected resources MMC Snap-ins Database of accounts Security Policy Security Monitor Logon authentication.NET Configuration Authorization Authentication.NET Application

Implementing Windows Security  Minimize services  Define the user account for anonymous access  Secure the file system  Apply specific registry settings

Securing file system wwwRoot Executables Scripts Include Static Images

Specific registry settings SynAttackProtect register value to HKLM\System\Currentcontrolset\Services\ Tcpip\Parameters\SynAttackProtect  TCPMaxPortsExhausted  TCPMaxHalfOpen  TCPMaxHalfOpenedRetired

Configuring Security settings  Configuring account policies Password policy Password policy Account lock out policy Account lock out policy  Configuring Local Policies Audit policy Audit policy User Rights Assignment User Rights Assignment Security Options Security Options

Walkthrough to configure the Account policies and Local policies….

By pass traverse checking Will it work? By pass traverse checking Will it work? DirA DirB DirC File.txt User A User A has no rights to access folder A User A has full access to file file.txt

Here goes the answer!

By pass traverse checking  Is user checked for permissions???

Token  Token unifies data about identity:  User’s SID  Group SID  Privileges  Every process has own token representing principal  First process are running on behalf of the SYSTEM account when computer is started  When user logs on then shell is running in user mode under specific principal  WinLogon.exe (SYSTEM) starts user’s shell with CreateProcessAsUser method => then user’s token is propagated to other processes

What are Principal and Identity objects?  WindowsIdentity: This object encapsulates the Windows login user name and the type of protocol adopted for authentication by Windows  GenericIdentity: also stores information about a user, but is used when an application needs to implement custom logon.  GenericPrincipal: This object encapsulates the identity object and the role  WindowsPrincipal: also stores identity and the Windows group membership of the user.

User Roles  Acquiring User’s name.  Displaying all the roles in which user is a member.

Accessing token  Is token in WindowsIdentity?  Acquiring token from running process  User’s name and SID from GetTokenInformation

Runtime security through windows  Increase Assembly Trust  Adjust Zone Security  Evaluate Assembly  Create Deployment Package  Reset All Policy Levels

Walkthrough to configure the runtime security policies….

References  Windows Security 2 nd Edition by Ben Smith and Brain Komar.  h.GuideBook/HowToGetATokenForAUser. html h.GuideBook/HowToGetATokenForAUser. html h.GuideBook/HowToGetATokenForAUser. html  ngOut.zip ngOut.zip ngOut.zip

Questions? Questions?