Implementing Application Security Using the Microsoft.NET Framework

!

" #

!

!

" #

!

$ %

$ %

& '

& '

!

"

!

"

!

!

$

(

$

(

%

" %

" #

%

" %

" #

' " #

' " #

' "

" #

' "

" #

(

(

)

)

#

#

!

!

*

"

$

(

*

"

$

(

+

'

+

'

%

%

%

%

%

%

%

%

%' ,

%' ,

%' ,

%' ,

%' ,

%' ,

%' ,

%' ,

'

'

'

'

'

'

'

'

"

%%, %

-

% %

"

"

%%, %

%%, %

-

-

% %

% %

"

%%, %

-

% %

"

%%, %

-

% %

"

%%, %

-

% %

"

%%, %

-

% %

"

%%, %

-

% %

#

, %

#

, %

#

, %

#

, %

#

, %

#

, %

#

, %

#

, %

%

,

, %

'

'

%

%

,

,

, %

, %

'

'

'

'

%

,

, %

'

'

%

,

, %

'

'

%

,

, %

'

'

%

,

, %

'

'

%

,

, %

'

'

%

%

%

%

%

%

%

%

%

%

%

%

%

%

%

%

%

%

%

%

%

%

%

%

%

.

%

.

%

.

%

.

%

.

%

%

.

.

%

.

)

)

'

'

'

'

'

'

'

'

%

%

%

%

%

%

%

%

'

'

'

'

'

'

'

'

'

%

%

'

%

%

'

%

%

'

%

%

'

%

%

'

%

%

'

%

%

'

%

%

'

,%%

'

"

'

,%%

'

"

'

,%%

'

"

'

,%%

'

"

'

,%%

'

"

'

,%%

'

"

'

,%%

'

"

'

,%%

'

"

%

, %'

"

%

%

, %'

, %'

"

"

%

, %'

"

%

, %'

"

%

, %'

"

%

, %'

"

%

, %'

"

/

/

/

/

/

/

/

/

Bill Gates

More than 250 million copies distributed

More than 250 million copies distributed

1/3 fewer vulnerabilities; 1/2 the # of

1/3 fewer vulnerabilities; 1/2 the # of

criticals

criticals

15 times less likely to be infected by

15 times less likely to be infected by

malware

malware

Service Pack 2

Malicious Software

Removal Tool

01)

-

2

344

01)

-

2

344

!

!

"

"

%

%

5

%

%

5

)

)

%"

%

%"

%

01

01

6

%' #

6

%' #

As of December 2005 As of December 2005 Service Pack 1

". %

". %

' %

2

' %

' %

2

' %

78

%"

%

78

%"

%

#

$

#

$

!

%

!

%

Attacker needs to understand only one security issue

Defender needs to secure all entry points Attacker has unlimited time

Defender works with time and cost constraints Attacker needs to understand only one security issue

Defender needs to secure all entry points Attacker has unlimited time

Defender works with time and cost constraints Attackers vs. Defenders

Developers and management think that security does not add any business value

Addressing security issues just before a product is released is very expensive

Developers and management think that security does not add any business value

Addressing security issues just before a product is released is very expensive Security As an Afterthought Do I need security …

Secure systems are more difficult to use Complex and strong passwords are difficult to remember

Users prefer simple passwords

Secure systems are more difficult to use Complex and strong passwords are difficult to remember

Users prefer simple passwords Security vs. Usability

&

'

&

'

(

(

& #"

%

& #"

%

%

%

$

'

'(

$

'

'(

%

%

%

%

%

%

"

"

% "

%

"

"

% "

%

9

:

9

:

"

"

%

(

%

(

;

;

'

'

%

%

%

%

%

(

%

(

+ %

+ %

%

,

%

,

%

(

%

(

%

"

'

%

"

'

"

:

%

"

:

%

"

%%

"

%%

"

"

%

' (

%

' (

"

" #

"

" #

"

' %

"

' %

&

# #

%

%

&

# #

%

%

" % %

" % %

"

%

"

%

"

%

#

"

%

#

$

$

%

"

%

%

%

%

%

%

$

%

%

%

" #

+

' %

9

%

+

"

%

$ %

"

$ %

"

9

9

"

<

=<

%

9

9

'

"

$ $>

%

$

9

9

%

% %

% %

)

)

)

)

( "

( "

)

)

$

$

;

;

?< @

?< @

“All input is evil until proven

otherwise!”

&

)

&

)

)

)

$

$

;

;

?< @

?< @

" *

" *

!

" #

(

!

" #

(

%

%

%

,

% (

%

,

% (

$

#

$

#

-$

& %"

$

& %"

-'

% -

'

%

-'

% -

'

%

•

• Managed execution Managed execution environment

environment

•

• Unified programming models Unified programming models

across Rich/Thin Client

across Rich/Thin Client

•

• CrossCross--language integrationlanguage integration

•

• One single set of APIOne single set of API

•

• Delivers Rich/Thin Delivers Rich/Thin

Clients/XML Web Services

Clients/XML Web Services

•

• Supports Many LanguagesSupports Many Languages

•

• Windows Application ServicesWindows Application Services

Win32 Win32 MSMQ MSMQ (Message (Message Queuing) Queuing) COM+ COM+ (Transactions, Partitions, (Transactions, Partitions, Object Pooling, …)

Object Pooling, …) IISIIS WMIWMI

Common Language Runtime

Common Language Runtime

Base Class Library

Base Class Library

ADO.NET: Data and XML

ADO.NET: Data and XML

Web Services/

Web Services/WebFormsWebForms _{Windows Windows}

Forms Forms VB.NET VB.NET C++C++ C#C# ASP.NET ASP.NET … … 30+ Languages 30+ Languages

(

(

9 :

%

A

' # B

9 :

%

A

' # B

9 % %

'

9 % %

'

;

;

%

%

'

'

(

(

$

%

' C

$

%

' C

'

'

" %

" %

;

;

'

'

;

;

%

%

+

+

"

"

,

,

"

"

+

+

-

-

"

"

%

(

%

(

%"

'

%%

%"

'

%%

% %

% %

'

'

$

%

' C(

$

%

' C(

9+<

9+<

D

D

%

%

$

%

%'

$

%

%'

$

$

' %

%

%

$

$

%

%

'

%

#%

AB

$ %

$ %

%

!

%

!

%

! "

#

! "

#

$ % & $ % & ' ( ) *

0

0

'

'

:

:

%

'

%

'

3

3

E

E

'

'

:

:

!

" #

'

!

" #

'

F

F

#

:

%

#

:

%

8

8

"

-"

-' ( ) $ % & ' ( ) $ % & ' ( ) $ % & + ( % ( % * , ( % ( % * , ( % ( % ' ( -' (

-!

!

#(

#(

$

'@

$

'@

$

%

$

%

#(

#(

9

'

9

'

%

%

>

%

#(

>

%

#(

9

%

9

%

#" #

#" #

&

)

&

)

! "

! "

9

!

" #$

9

!

" #$

$

#

$

#

+ :

+ :

,

)

,

)

,

,

%

%

%

%

& '

%

& '

%

'

%

'

%

'

9

'

9

'

% '

'

% '

'

9

'

9

%

%

%

%%

%

%%

%

%

;

;

'

'

%

%

-' %

-' %

,

,

,

$

,

$

,

$

,

$

,

,

,

,

&

&

&

&

&

!

!

!

!

. . ._. ._. (₍ , $ " , $ "

,

$ "

,

,

$ "

$ "

,

$ "

, , ,_, / , $ " / , $ " 0. . ! . !

,

,

,

A

%

B

A

%

B

(

=

=

"""

(

=

=

"""

(

=

=

"""

(

=

=

"""

(

=

=

"""

(

=

=

"""

(

=

=

"""

(

=

=

"""

=

=

=

=

=

=

=

=

A

%

B

A

%

B

(

=

=

(

=

=

(

=

=

(

=

=

(

=

=

(

=

=

(

=

=

(

=

=

%

%

%

%

%

%

%

%

=

=

=

=

=

=

=

=

A

B

A

B

(

=

=

"""

(

=

=

"""

(

=

=

"""

(

=

=

"""

(

=

=

"""

(

=

=

"""

(

=

=

"""

(

=

=

"""

=

=

=

=

=

=

=

=

=

=

=

=

=

=

=

=

.

&

!

.

&

!

@

@

;

;

G

G

& %"

& %"

>

$

>

$

(

=

=

"""

(

=

=

"""

@

@

;

;

9

6

9

6

(

=

=

"""

(

=

=

"""

#

#

0

"

0

"