1. Securing Your ASP.NET Application Presented by: Rob Bagby Developer Evangelist Microsoft rob.bagby@microsoft.comrob.bagby@microsoft.com (email) rob.bagby@microsoft.com http://www.robbagby.comhttp://www.robbagby.com (blog) http://www.robbagby.com

2. Security Overview / Basics ASP.NET Security Architecture Authentication Authorization Input Validation Database Sensitive Data Session Agenda

3. Defense-In-Depth Security – The concept that many layers of security is better than one layer. Security Overview

4. Threat Modeling Structured approach to: Evaluate security threats Identify countermeasures DREAD helps rate risk Damage potential ReproducibilityExploitability Affected users Discoverability More information in MSDN Patterns and Practices http://msdn.microsoft.com/library/en- us/dnnetsec/html/ThreatCounter.asp http://msdn.microsoft.com/library/en- us/dnnetsec/html/ThreatCounter.asp Threat Modeling Process 1. Identify Assets 2. Create an Architectural Overview 3. Decompose the Application 4. Identify the Threats 5. Document the Threats 6. Rate the Threats

5. Session Agenda Security Overview / Basics ASP.NET Security Architecture Authentication Authorization Input Validation Database Sensitive Data

6. ASP.NET Architecture - Overview

7. Gatekeepers – The authorization points within an ASP.NET application that are provided by: IIS ASP.NET IIS Permits requests from users that it can authenticate (with anonymous turned off) Uses NTFS permissions to perform access control ASP.NET Architecture - Gatekeepers

8. ASP.NET – has 2 gatekeepers UrlAuthorizationModule Configure elements in Web.Config to configure access Based on IPrincipal (stored in HttpContext.User) FileAuthorizationModule For file types mapped to the ASP.NET ISAPI ext. Access checks done using the authenticated users token Could be the anonymous account ASP.NET Architecture - Gatekeepers

10. Declarative [PrincipalPermission(SecurityAction.Demand, Role=@"DomainName\WindowsGroup)] Imperative PrincipalPermission permCheck = new PrincipalPermission( null, @"DomainName\ WindowsGroup"); permCheck.Demand(); ASP.NET Architecture (Principal Permission Demands)

11. Session Agenda Security Overview / Basics ASP.NET Security Architecture Authentication Authorization Input Validation Database Sensitive Data

12. The process by which a user is uniquely identified, given his/her credentials. Authentication Options Windows w/ impersonation Windows w/o impersonation Forms Passport Authentication

13. Operating system authenticates user Requires valid windows account Transparent access to resources WindowsIdentity WindowsIdentity widentity = WindowsIdentity.GetCurrent(); IIdentity iidentity = WindowsIdentity.GetCurrent(); Authentication - Windows (Overview)

14. Configuration Advantages ACLs for Resources accessed by your app. Flow caller ’ s identity to middle tier Disadvantages Reduced scalability – database pooling Requires windows account for each user Increased administration Authentication - Windows (w/ Impersonation)

15. Configuration (or no identity ele.) Advantages ACLs for Client Requested Resources URL Authorization Disadvantages Requires windows account for each user Increased administration Authentication - Windows (w/o Impersonation)

16. Configuration Advantages No Windows accounts required Firewall friendly Disadvantages You have to implement / write Authentication - Forms

17. Configuration Advantages Single sign-on Disadvantages Non-trivial to implement Authentication - Passport

18. Session Agenda Security Overview / Basics ASP.NET Security Architecture Authentication Authorization Input Validation Database Sensitive Data

19. The Process By which The System Validates That The Authenticated User Has Access To Resources Or Has Privileges To Perform Certain Operations. Options Depend upon Authentication type Windows w/ impersonation Windows w/o impersonation Forms Passport Authorization

20. Behaviors ACLs Client Requested Resources: Original Caller ’ s token Resources Accessed by Application: Original Caller ’ s token URL Authorization: Original Caller ’ s Group or User Authorization - Windows (w/ Impersonation)

21. Behaviors ACLs Client Requested Resources: Original Caller ’ s token Resources Accessed by Application: ASP.NET process identity URL Authorization: Original Caller ’ s Group or User Authorization - Windows (w/o Impersonation)

22. Behaviors ACLs Client Requested Resources: ACLs must allow read access to anonymous Internet user account File Authorization not available Resources Accessed by Application: ASP.NET process identity URL Authorization: Determined by custom data store. Sql example: Authorization - Forms

23. .NET Role-Based Options Declarative Demands With PrincipalPermissionAttribute (1 Role) [PrincipalPermissionAttribute(SecurityAction.Demand, Role= “ MyRole ” )] Imperative Demands Using PrincipalPermission Object (Multiple) public void MyMethod { PrincipalPermission perm = New PrincipalPermission(null, “ MyRole ” ); perm.Demand(); } Role Checks With IsInRole (Multiple) Principal.IsInRole( “ MyRole ” ); Custom Authentication Role Checks string[] roles = new string[] { “ MyRole ”, “ MyRole1 ” }; IPrincipal principal = new GenericPrincipal(identity, roles); principal.IsInRole( “ MyRole ” ); Authorization cont. (Role-Based)

24. Defense-In-Depth Approach Granular Roles Declarative Demands, Where Possible Use IsInRole If You Need to Check > 1 Role Membership Authorization cont. (Guidelines)

25. ASP.NET Forms Authentication demo

26. Session Agenda Security Overview / Basics ASP.NET Security Architecture Authentication Authorization Input Validation Database Sensitive Data

27. Assume all input is malicious Centralize your approach Do not rely on client-side validation Be careful with canonicalization issues Constrain, reject, and sanitize your input Input Validation

28. Session Agenda Security Overview / Basics ASP.NET Security Architecture Authentication Authorization Input Validation Database Sensitive Data

29. Use Stored Procedures Grant Access Only To Stored Procedures Parameterize Queries, When SPs Not Possible Use Least-Privileged Account Approach Protect Connection Strings As Secrets Hash Passwords Encrypt Sensitive Data Database

30. Session Agenda Security Overview / Basics ASP.NET Security Architecture Authentication Authorization Input Validation Database Sensitive Data

31. Hashing – Practically Impossible To Reverse Encryption – Can Only Decrypt With Encryption Key DPAPI – Data Protection API Sensitive Data

32. Sensitive Data Cont. I want to…RecommendationAdvantagesLimitations Store a user password securely Salt + SHA1 (One-way hash) Prepend random salt to the passwords before hashing to defend against off-line dictionary attacks. No keys to manage. Identical input yields identical hash values. Must store a salt to ensure unique cipher text for identical values.

33. Sensitive Data Cont. I want to…RecommendationAdvantagesLimitations Store a user password securely Salt + SHA1 (One-way hash) Prepend random salt to the passwords before hashing to defend against off-line dictionary attacks. No keys to manage. Identical input yields identical hash values. Must store a salt to ensure unique cipher text for identical values. Protect local user data DPAPI (Encryption using keys derived from user credentials) DPAPI manages keys on behalf of the application. Data can’t be decrypted by other users, or on other machines.

34. Sensitive Data Cont. I want to…RecommendationAdvantagesLimitations Store a user password securely Salt + SHA1 (One-way hash) Prepend random salt to the passwords before hashing to defend against off-line dictionary attacks. No keys to manage. Identical input yields identical hash values. Must store a salt to ensure unique cipher text for identical values. Protect local user data DPAPI (Encryption using keys derived from user credentials) DPAPI manages keys on behalf of the application. Data can’t be decrypted by other users, or on other machines. Encrypt data that will need to decrypted later Symmetric encryption algorithms (e.g. Rijndael) Flexible: data can be decrypted by other apps / machines that have the key. Application must manage keys and transmit them securely.

35. Sensitive Data demo

36. Wrap-up & Questions … Rob Bagby Developer Evangelist Microsoft rob.bagby@microsoft.comrob.bagby@microsoft.com (email) rob.bagby@microsoft.com http://www.robbagby.comhttp://www.robbagby.com (blog) http://www.robbagby.com