Security.

Slides:



Advertisements
Similar presentations
iRequestManager for MediMizer X3
Advertisements

ASP.NET Web Application Security Hannes Preishuber ppedv AG
Kerberos Jean-Anne Fitzpatrick Jennifer English. What is Kerberos? Network authentication protocol Developed at MIT in the mid 1980s Available as open.
Online Security Tuesday April 8, 2003 Maxence Crossley.
Information Networking Security and Assurance Lab National Chung Cheng University The Ten Most Critical Web Application Security Vulnerabilities Ryan J.W.
Introduction To Windows NT ® Server And Internet Information Server.
Copyright © Clifford Neuman - UNIVERSITY OF SOUTHERN CALIFORNIA - INFORMATION SCIENCES INSTITUTE CSci530: Computer Security Systems Authentication.
How Clients and Servers Work Together. Objectives Learn about the interaction of clients and servers Explore the features and functions of Web servers.
Security in SQL Jon Holmes CIS 407 Fall Outline Surface Area Connection Strings Authenticating Permissions Data Storage Injections.
Access Control in IIS 6.0 Windows 2003 Server Prepared by- Shamima Rahman School of Science and Computer Engineering University of Houston - Clear Lake.
Jonas Thomsen, Ph.d. student Computer Science University of Aarhus Best Practices and Techniques for Building Secure Microsoft.
Web Application Vulnerabilities Checklist. EC-Council Parameter Checklist  URL request  URL encoding  Query string  Header  Cookie  Form field 
CRYPTOGRAPHY PROGRAMMING ON ANDROID Jinsheng Xu Associate Professor North Carolina A&T State University.
1 CSE 403 Web Security Testing Reading: Andrews/Whitaker, How to Break Web Software, Ch. 2-5 These lecture slides are copyright (C) Marty Stepp, 2007.
Session 11: Security with ASP.NET
Introduction to SQL Server 2000 Security Dave Watts CTO, Fig Leaf Software
Chapter 13 – Network Security
© All rights reserved. Zend Technologies, Inc. PHP Security Kevin Schroeder Zend Technologies.
Security Testing Case Study 360logica Software Testing Services.
© FPT SOFTWARE – TRAINING MATERIAL – Internal use 04e-BM/NS/HDCV/FSOFT v2/3 Securing a Microsoft ASP.NET Web Application.
Protecting Internet Communications: Encryption  Encryption: Process of transforming plain text or data into cipher text that cannot be read by anyone.
All Input is Evil (Part 1) Introduction Will not cover everything Healthy level of paranoia Use my DVD Swap Shop application (week 2)
1 Chapter Overview Password Protection Security Models Firewalls Security Protocols.
Module 11: Securing a Microsoft ASP.NET Web Application.
Cookies COEN 351 E-commerce Security. Client / Session Identification HTTP Headers Client IP Address HTTP User Login FAT URLs Cookies.
PHP Secure Communications Web Technologies Computing Science Thompson Rivers University.
COMP9321 Web Application Engineering Semester 2, 2015 Dr. Amin Beheshti Service Oriented Computing Group, CSE, UNSW Australia Week 9 1COMP9321, 15s2, Week.
Module 7: Implementing Security Using Group Policy.
© Copyright 2009 SSLPost 01. © Copyright 2009 SSLPost 02 a recipient is sent an encrypted that contains data specific to that recipient the data.
Password Security Module 8. Objectives Explain Authentication and Authorization Provide familiarity with how passwords are used Identify the importance.
E-Commerce and Security Dr. John P. Abraham Professor University of Texas Pan American.
Session 11: Cookies, Sessions ans Security iNET Academy Open Source Web Development.
ASP.NET 2.0 Security Alex Mackman CM Group Ltd
Maryknoll Wireless Network Access Steps for Windows 7 As of Aug 20, 2012.
1-way String Encryption Rainbows (a.k.a. Spectrums) Public Private Key Encryption HTTPS Encryption.
Defense In Depth: Minimizing the Risk of SQL Injection
Unit 3 Section 6.4: Internet Security
Web Security CS-431.
Tonga Institute of Higher Education IT 141: Information Systems
SQL Server Security & Intrusion Prevention
IT443 – Network Security Administration Instructor: Bo Sheng
Configuring ALSMS Remote Navigation
Encryption 1-way String Encryption Rainbows (a.k.a. Spectrums)
Penetration Test Debrief
Web Development Web Servers.
Configuring Windows Firewall with Advanced Security
Chapter 5 : Designing Windows Server-Level Security Processes
CS 371 Web Application Programming
Chapter 8 Building the Transaction Database
Jim Fawcett CSE686 – Internet Programming Summer 2005
Introduction to SQL Server 2000 Security
Using SSL – Secure Socket Layer
Security.
Ways to Secure CMS Websites. The most widely used Content Management Systems are Wordpress, Joomla and Drupal as per statistics. The highest CMS platforms.
12 E-Commerce Overview.
Securing the Channel.
Web Systems Development (CSC-215)
Defense in Depth Web Server Custom HTTP Handler Input Validation
Tonga Institute of Higher Education IT 141: Information Systems
REDCap and Data Governance
Tonga Institute of Higher Education IT 141: Information Systems
Chapter 7 Network Applications
Unit 32 Every class minute counts! 2 assignments 3 tasks/assignment
Designing IIS Security (IIS – Internet Information Service)
Electronic Payment Security Technologies
Q/ Compare between HTTP & HTTPS? HTTP HTTPS
6. Application Software Security
Fast-Track UiPath Developer Module 10: Sensitive Data Handling
Security - Forms Authentication
Presentation transcript:

Security

All Input is Evil (Part 1)

Introduction Will not cover everything Healthy level of paranoia Use my DVD Swap Shop application (week 2)

http://www. theguardian http://www.theguardian.com/technology/2015/aug/19/ashley-madison-hackers-release-10gb-database-of-33m-infidelity-site-accounts

Security Considerations Authentication  Authorisation Secure communication Software + Hardware  

The Login Provides authentication asterisks ********* SQL injection attack

Human Problems A simple conversation People use words they can remember Same passwords for many sites Doctor who fan guess the password T****S

Dictionary Attacks If you know a user name throw the dictionary at it

Brute Force Attack If the password is CC but all we know is that it is two characters long ** AA AB BA BB BC CB CC The longer the password the more time we need to crack it.

Countermeasures Education Enforce rules in code Don’t use same password for all sites Avoid passwords that could be guessed Don’t use dictionary words Enforce rules in code Minimum password length Non alpha numeric characters Expiration date Limit login attempts

Use a Security Framework Authentication options in .NET Windows Passport Forms DIY

Securing Stored Passwords Unsecured Access database Stored in App_Data folder (Could store on another drive/machine) Plain text password stored in the table

Password Hashing .NET Cryptography Encryption is ok Hashing better IKSV2XlTzgf7LFJNFuHDkf9f4WQPZPLnEIY= Do not store the password in plain text

Adding Salt If the passwords for John and Fred without salt look like this... John IKSV2XlTzgf7LFJNFuHDkf9f4WQPZPLnEIY= Fred IKSV2XlTzgf7LFJNFuHDkf9f4WQPZPLnEIY= Adding salt would change the hash values like so...   John 354rlrk8Jv7729qVOrOp0lXUv7RAsdV Fred 9Wo0irC6+ylay0CJsLVtWBfbJBSn03j4gzhG Concatenate password + email address

Validation Who do you trust? Do you trust me not to make use of that data in some way?  Do you trust me to write a web application that will not be compromised in any way? Not just a matter of what people you trust but what systems do you trust? Exclude list = characters we don’t allow Include list = characters we do allow

Code Injection Script could run when page is rendered elsewhere in application IIS automatically disallows this

Turn Off Debug Mode By entering bad data a hacker could crash your program

We now Know The language of the application (VB.NET) The names of several parameters SwapTitle Description etc.. In the light of the above probably the names of some fields in the database (this way the hacker may refine the SQL injection attacks.) The remote path on the server C:\MyFiles\IMAT1604\content\Widget Swap\Widget Swap\aswap.aspx.vb

Securing the Communication Channel

Public and Private Keys

Public and Private Keys

Secure Socket Layer (SSL) The browser makes a secure HTTP request HTTPS on port 443 The server sends back a digital certificate verifying its credentials The client verifies the certificate with the issuing agency Using the public key the data is encrypted between client and server

Open Ports Port scanners Firewalls IP Filtering Turn off unused services Grant Minimum Permissions to Resources