	Essential .NET Security

Modules

1. Threats and Mitigation
This first module identifies and categorizes the general threats posed to apps running on the .NET platform, and discusses how to prioritize and mitigate them. Also included are general tips on security issues you should be thinking about when designing and implementing software, as well as ideas on how to make security a more integral part of the software development process. You can't just bolt security on at the end, as so many have discovered the hard way!

Slides Quiz

2. Conventional Cryptography and Kerberos
Many security techniques revolve around cryptography and strong authentication. This module introduces symmetric (secret) key cryptography and the .NET Framework classes that expose it. This module will teach you how to convert a password or passphrase into a conventional key, and how to measure the strength of that key. It provides guidelines on choosing cryptographic algorithms and key lengths as well as the coding techniques you'll need to implement cryptography in your .NET application. The module ends by describing the Kerberos authentication protocol, giving some practical advice about using it, as well as some .NET classes that make it possible to "Kerberize" a C# or VB.NET application.

Slides Exercises Quiz

3. Public Key Cryptography and SSL
This module introduces asymmetric (public) key cryptography and certificates. It recommends an architecture for digitally signing messages and creating "enveloped" messages in a standard format that can only be decrypted by selected recipients. The current recommendation and focus is on using CAPICOM from .NET, as there is currently no native support for this in the .NET Framework. We explain how to install and use CAPICOM in a .NET environment and provide labs that allow you to use certificates to sign and encrypt messages and communicate them around the room using the .NET socket classes. We wrap up with a look at how SSL works.

Slides Exercises Quiz

4. Windows Security 101
This is a whirlwind tour of features in the operating system that are important for developers to know. This is the first of two modules on the topic, and it discusses the Trusted Computing Base, principals, authorities, groups, privileges, tokens, logon sessions, window stations, and the secondary logon service. The student will also get an introduction to Role Based Security in the .NET Framework via Thread.CurrentPrincipal and PrincipalPermissionAttribute.

Slides Exercises Quiz

5. Windows Security 102
This second module on operating system security focuses on client identity management in distributed systems. This includes impersonation and delegation, and discusses the difference in the delegation model between Windows 2000 and Windows Server 2003, where constrained delegation and protocol transition give you much more flexibility in building authentication systems.

Slides Exercises Quiz

6. Code Access Security: part 1, policy
Lots of people are excited about the ease of deployment of Windows Forms applications on their intranet. Just whip up a rich client, pop it on an internal Web server, and let clients execute it from there. Need to deploy a change? No problem! Just put the new version on the server and clients get it automatically the next time they run the application. There's only one drawback. That Windows Forms application is considered mobile code and is subject to some very severe security restrictions on what it can do. This module will motivate the need for this new security model, teach you how it works, and give you the tools you need to work within its boundaries. In this first module we focus on evidence, permissions, and policy.

Slides Exercises Quiz

7. Code Access Security: part 2, enforcement
This module covers the CAS stackwalk, discussing issues in building secure gateways to secured resources - issues such as assertion of permissions, for example. This is followed by a discussion that clears up the oft misunderstood attribute AllowPartiallyTrustedCallers, explaining why it's there and how to use it. Also included is a discussion of Isolated Storage, which is an important resource when writing mobile code. We wrap up with a discussion of how to implement custom permissions, which is really a great way to learn how CAS works.

Slides Exercises Quiz

8. Web Application Security
When developing a Web application, it's critical to understand the authentication options that are available so that you can make an informed decision when choosing one. For instance, Kerberos is a great choice for closed Intranet applications, but for public web applications, SSL coupled with basic authentication or some sort of forms authentication is much more reliable. This module will describe the HTTP pipeline that ASP.NET uses, and the security services provided at each point in the pipeline, including Integrated Windows authentication, Forms authentication, and role-based authorization. New security features in IIS 6 will also be covered.

Slides Exercises Quiz

9. Web Service Security
The never-ending question - how do I secure my Web service? This module will discuss the current practical thoughts on authentication models for Web services, as well as future models proposed with the Global XML Architecture (GXA), including the WS-Security spec. Included are discussions of XML canonicalization, XML signature, and XML encryption.

Slides Exercises Quiz

10. Remoting
Out of the box, the .NET Remoting architecture has no security at all. No authentication, no message integrity or confidentiality protections, nothing. This discussion shows how to layer security onto this very flexible and open architecture that is destined to replace DCOM for object-based communication on the intranet. We show both how to host in IIS as well as how to use the SSPI channel sink released by the remoting team in August 2002, which layers Kerberos onto .NET Remoting. This discussion a must for anyone building systems based on .NET Remoting.

Slides Exercises Quiz

11. COM+
This module focuses on the COM+ security model, showing how to use DCOM security to build secure distributed applications. The System.EnterpriseServices namespace in the .NET Framework provides managed code access to COM+ services, and this module discusses the subtleties of using these classes.

Slides Exercises Quiz

12. Dumb Code
This module teaches how to write robust code by showing examples of bad code and the security holes it opens. This is followed with a discussion of how to avoid the problem. There are so many common attacks that developers need to be aware of: buffer overflows, SQL injection attacks, cross site scripting, format string vulnerabilities, elevation of privilege attacks, etc.

Slides Quiz