Implementing Application Security Using the Microsoft.NET Framework

Size: px

Start display at page:

Download "Implementing Application Security Using the Microsoft.NET Framework"

Ami Riley
8 years ago
Views:

1 !"#! $ &' This presentation is for informational purposes only. Microsoft makes no warranties express or implied in this summary. 1

2 !"! $( ""# ' "# ' " "# ( ) #! *"$ ( + ' ' ' "- # ' '. )'' '' ' '' " '" / Bill Gates July This presentation is for informational purposes only. Microsoft makes no warranties express or implied in this summary. 2

3 #$ Service Pack 2 Service Pack 1 More than 250 million copies distributed 1/3 fewer vulnerabilities; 1/2 the # of criticals 15 times less likely to be infected by malware ". '2' 78 " " 01 6'# Malicious Software Removal Tool 01) -2344! " 5) As of December 2005! Attacker needs to understand only one security issue Defender needs to secure all entry points Attacker has unlimited time Attackers vs. Defenders Defender works with time and cost constraints Security vs. Usability Do I need security Security As an Afterthought Secure systems are more difficult to use Complex and strong passwords are difficult to remember Users prefer simple passwords Developers and management think that security does not add any business value Addressing security issues just before a product is released is very expensive This presentation is for informational purposes only. Microsoft makes no warranties express or implied in this summary. 3

Attacker needs to understand only one security issue Defender needs to secure all entry points Attacker has unlimited time Attackers vs.

4 & ' ( &#" $''( """ 9: " ( ;' ( + ( " ' ": " This presentation is for informational purposes only. Microsoft makes no warranties express or implied in this summary. 4

5 " '( ""# "' & # # " " "# $ $" ) " $ "# +' 9 +" "<=< '"$$> $ This presentation is for informational purposes only. Microsoft makes no warranties express or implied in this summary. 5

6 (" ) $;?<@ All input is evil until proven otherwise! &) ) $;?<@ This presentation is for informational purposes only. Microsoft makes no warranties express or implied in this summary. 6

7 "*!"#( ( $# - $ &" -' -' VB.NET C++ C# 30+ Languages Supports Many Languages Web Services/WebForms ASP.NET Base Class Library Windows Forms ADO.NET: Data and XML Common Language Runtime Delivers Rich/Thin Clients/XML Web Services Unified programming models across Rich/Thin Client Cross-language integration One single set of API Managed execution environment MSMQ (Message Queuing) COM+ (Transactions Partitions Object Pooling ) IIS WMI Windows Application Services Win32 This presentation is for informational purposes only. Microsoft makes no warranties express or implied in this summary. 7

Cross-language integration One single set of API Managed execution environment MSMQ (Message Queuing) COM+ (Transactions Partitions Object Pooling )

8 +" ( 9:A' #B 9 ' ;' ' ( $' C ' ";' '; "+-" ( "' ' $ ' C( 9+< D $' This presentation is for informational purposes only. Microsoft makes no warranties express or implied in this summary. 8

9 $ $ ' $ $ ' #AB! $ & $ & ' ( ) * ' ( ) $ &! " # ' ( ) $ & + ( ( 0 ' : ' 3 E' :!"#' F #: 8 "- ' * ( ( ( - This presentation is for informational purposes only. Microsoft makes no warranties express or implied in this summary. 9

10 ! #( $ #( 9' >#( 9 #" # &)!" 9!"#$ $# +: This presentation is for informational purposes only. Microsoft makes no warranties express or implied in this summary. 10

11 ) &' ' '9 ' ' '9 ;' -'! ( (.! $ $ " /$ " " $ $ " " & 0. & This presentation is for informational purposes only. Microsoft makes no warranties express or implied in this summary. 11

12 A B (==""" = A B (== = A B (==""" = = = This presentation is for informational purposes only. Microsoft makes no warranties express or implied in this summary. 12

13 .&! G &" > $ (=="""@@; 96 (=="""# # 0" This presentation is for informational purposes only. Microsoft makes no warranties express or implied in this summary. 13

HowThe Most Effective Way To Get Rich Fast!

HowThe Most Effective Way To Get Rich Fast! !"#$%&'()%*+,,,!-'()%*./+&012'%3"#$%3&'()%*!4-'()%*./+,,,!-'(5%./+677!4-'(5%./+,,,!)(*890':#*9-+,,,,,!)(*980':#*9+!;01%+!4;01%+!4)(*980':#*9+,,,!4)(*890':#*9-+,,,!5#12#;%;9-+,,,,,!"#$%&'()%*>#12#;%;9+,,,,,,,!;01%+?:!4;01%+,,,,,,,!9@2%+?0-9:09A3=0*%B%90'!49@2%+,,,,,,,!-8C9@2%+DB.!4-8C9@2%+,,,,,,,!(;9%*E05%-+,,,,,,,,,!;81FE.;9%*E05%-+G!4;81FE.;9%*E05%-+,,,,,,,!4(;9%*E05%-+,,,,,,,!*%-#8*5%+,,,,,,,,,!528+6!4528+,,,,,,,,,!5281#$%+$%$(509%$!45281#$%+,,,,,,,,,!1%1#*@,8;(9HIB=I+JGK!41%1#*@+,,,,,,,!4*%-#8*5%+,,,,,,,!20*01%9%*-+,,,,,,,,,!C##9.10L%+A992M44%N012'%O5#14DB.3C(;0*@,!4C##9.10L%+,,,,,,,,,!C##9:0*01-4+,,,,,,,!420*01%9%*-+,,,,,!4"#$%&'()%*>#12#;%;9+,,,,,!"#$%&'()%*>#12#;%;9+,,,,,,,!;01%+&:!4;01%+,,,,,,,!9@2%+&'#P:09A3QB!49@2%+,,,,,,,!-8C9@2%+RQB!4-8C9@2%+,,,,,,,!(;9%*E05%-+,,,,,,,,,!;81FE.;9%*E05%-+J!4;81FE.;9%*E05%-+,,,,,,,!4(;9%*E05%-+,,,,,,,!*%-#8*5%+,,,,,,,,,!528+6!4528+,,,,,,,,,!5281#$%+$%$(509%$!45281#$%+,,,,,,,,,!1%1#*@,8;(9HI=I+J7ST!41%1#*@+,,,,,,,!4*%-#8*5%+,,,,,,,!20*01%9%*-+,,,,,,,,,!C##9.10L%+A992M44%N012'%O5#14RQB3$(-UO(1L,!4C##9.10L%+,,,,,,,,,!C##9:0*01-4+,,,,,,,!420*01%9%*-+,,,,,!4"#$%&'()%*>#12#;%;9+,,,!45#12#;%;9-+,,,!5#;;%59(#;B02+,,,,,!"#$%>#;;%59(#;,9@2%HI:V9#V:I+,,,,,,,!-#8*5%+,,,,,,,,,!Q(*980'.;9%*E05%+,,,,,,,,,,,!5#12#;%;9+3Q:FDW3!45#12#;%;9+,,,,,,,,,,,!(;9%*E05%+!4(;9%*E05%+,,,,,,,,,!4Q(*980'.;9%*E05%+,,,,,,,!4-#8*5%+,,,,,,,!$%-9(;09(#;+,,,,,,,,,!Q(*980'.;9%*E05%+,,,,,,,,,,,!5#12#;%;9+?0-9:09A!45#12#;%;9+,,,,,,,,,,,!(;9%*E05%+J!4(;9%*E05%+,,,,,,,,,!4Q(*980'.;9%*E05%+,,,,,,,!4$%-9(;09(#;+,,,,,,,!C($(*+WDXY!4C($(*+,,,,,!4"#$%>#;;%59(#;+,,,,,!"#$%>#;;%59(#;,9@2%HI&P(95AI+,,,,,,,!Q(*980'.;9%*E05%+,,,,,,,,,!5#12#;%;9+?0-9:09A!45#12#;%;9+,,,,,,,,,!(;9%*E05%+Z!4(;9%*E05%+,,,,,,,!4Q(*980'.;9%*E05%+,,,,,,,!Q(*980'.;9%*E05%+,,,,,,,,,!5#12#;%;9+?0-9:09A!45#12#;%;9+,,,,,,,,,!(;9%*E05%+S!4(;9%*E05%+,,,,,,,!4Q(*980'.;9%*E05%+,,,,,,,!Q(*980'.;9%*E05%+,,,,,,,,,!5#12#;%;9+&'#P:09A!45#12#;%;9+,,,,,,,,,!(;9%*E05%+7!4(;9%*E05%+,,,,,,,!4Q(*980'.;9%*E05%+,,,,,,,!Q(*980'.;9%*E05%+,,,,,,,,,!5#12#;%;9+&'#P:09A!45#12#;%;9+,,,,,,,,,!(;9%*E05%+6!4(;9%*E05%+,,,,,,,!4Q(*980'.;9%*E05%+,,,,,!4"#$%>#;;%59(#;+,,,!45#;;%59(#;B02+,,,!20*01%9%*-+,,,,,!089AR%@+=0-%KS3Y;5#$%$3&-AR%@?('%!4089AR%@+,,,!420*01%9%*-+,!4"#$%&'()%*+,