Security in the .NET Framework

1
Security in the .NET Framework

• Mike Kass
• Product Manager
• Microsoft Corp.

2
The .NET Framework
3
. NET Framework Security

• Role-based Security
• Cryptographic Library
• Code Access Security

4
Role-Based Security Authentication

• Unified programming model for all forms of
  authentication
• Basic
• Digest
• NTLM
• Kerberos
• Microsoft Passport
• Forms/Custom
• Client Certificates

5
Role-Based Security Authorization

• Maximum flexibility again
• Access Control Lists
• Active Directory
• URL Authorization via Config Files
• Custom

6
Cryptographic Library

• Comprehensive, progressive set of APIs in the
  .NET Framework
• Easy, unified, stream-based architecture
• Encryption
• Digital signatures
• Hashing
• Random-number generation
• Pluggable extensibility (new algorithms)
• Uses Windows CryptoAPI functionality

7
Code Access Security

• Allows partially trusted code to run with reduced
  rights
• Evidence-based security model
• No more all-or-none or sandbox
• Granular permissions
• Flexible, extensible

8
3 Key Elements

• Evidence
• Inputs to policy about code
• Strong name, site, zone, Authenticode signature,
  hash value, app directory, etc.
• Permissions
• Specific authorizations for code (not users)
• Define a level of access to a resource or
  operation
• Policy
• Matches permissions to evidence via code groups
• Grants permissions to an assembly

9
Permissions Protect Resources

• FileIO
• FileDialog
• IsolatedStorage
• Environment
• Registry
• UI
• Printing
• Reflection
• Security

• Socket
• Web
• DNS
• OleDb
• SQLClient
• MessageQueue
• EventLog
• DirectoryServices
• extensible

Execution, Assertion, Skip Verification,
Unmanaged code, Control evidence, Control policy,
Control principal, Control threads
10
Loading An Assembly
Assembly Evidence
Assembly Requests

• 0. Compile code
• Load assembly
• Gather evidence
• Load policy
• Grant permissions
• Verify MSIL
• Execute code

Policy
Granted Permissions

11
Demands Make It Work
Demand of FileIOPermission () causes stack
walk If all frames pass Succeed, allow
operation Otherwise SecurityException()
MYAPP (semi-trusted) . . . . myComponent.ReadSetti
ng(key) . . . .
?
?
12
Default Security Policies

• Default code groups set around origin of code
  according to I.E. zones
• Local machine i.e. code installed locally
  
• Intranet
• Internet (enabled in version 1.1 of the .NET
  Framework currently in beta)
• Trusted sites
• Restricted sites

13
Local Machine Permissions

• FullTrust PermissionSet
• Full access to all machine capabilities
• But App must be installed on machine by
  machines admin

14
Intranet Permissions

• Unlimited UI
• Same protocol access to site DNS
• File read access to origin
• Open/Save File Dialog
• Default printer
• Unlimited Isolated Storage
• Write to Event Log
• Env for USERNAME, TEMP, TMP

15
Changing Security Policies

• Systems administrators can adjust current
  policies or create new policies via new code
  groups
• .NET Framework Configuration Tool (MMC snap-in)
• Caspol (Command line)
• Policies may be set at application, user,
  machine, and enterprise levels.

16
Programmatic access

• APIs to access code access security system
• Refuse unnecessary permissions
• Refuse to run if not granted necessary
  permissions
• Check to see if granted a permission and tweak
  app behavior based on response

17
Partially Trusted ASP.NET

• Coming in version 1.1
• For shared IIS 5.0 server, use CAS
• Isolate apps running in same process
• Set permissions on virtualized resources
• For shared IIS 6.0 server, use CAS
• Isolate apps you choose to run in same process
• Set permissions on virtualized resources

18
Trustworthy Computing

• External review, penetration testing
• Foundstone, CORE Security Technologies
• Foundstones Security in the Microsoft .NET
  Framework
• Used appropriately, we believe that the .NET
  Framework is one of the best platforms for
  developing enterprise and Web applications with
  strict security requirements.
• Ongoing internal security reviews testing

19
STPP and the .NET Framework

• Windows Update Patch Roll-ups
• Help customers get patches they need ASAP
• 2 Service Packs shipped to date

20
The .NET Framework in Curriculum

• Multi-language runtime environment
• Use the language you like
• Access the same class libraries to do similar
  tasks
• Use a powerful IDE to access easy-to-use learning
  tools
• Visual Studio .NET Academic
• Experience programming with .NET by building your
  own Terrarium creature at the Hands-On Lab (Booth
  301)

21
Microsoft Resources for Faculty

• MSDN Academic Alliance
• New program from Microsoft
• Software for computer science courses
• Annual membership fee of 799 per department
• Membership runs from July-June
• Web site that supports program (www.msdnaa.net)
• Visual Studio .NET Academic
• All the features of Visual Studio .NET
  Professional plus Course Management Tools

22
Questions?

• More info at
• http//msdn.microsoft.com/net/security