1. Security Autodesk DevDays 2013 - rEvolution
Where Desktop meets the Cloud
Jim Quanci
Director, Autodesk Developer Network

2. Something on everyone’s mind…
I know many of you – and your customers have security concerns and questions.
Security is a pretty big deal… and its just getting bigger. Adobe was hacked a month back. Angela Merkel had her mobile tapped. Customers have good reason to be concerned about the security of their data.

3. Don’t stick your head in the sand… YOU need to learn the security basics to create safe software and web services.

4. The Need Customer confidence and trust Reputation Publicity (negative)
Legal
The need is clear.
We must have customer confidence and trust – or we will fail.
There is also a significant real emotional component to security. The customer needs to know you are protecting their interests and not misusing their data.
At the same time we as a community do a better job securing our customers data and IT assets, we also all need to have frank conversations with our customers about how data is handled today – and how we can make their data more secure using the web and the cloud. How many customers send their design data to partners and customers by ?

5. Vulnerabilities - Desktop
Here are the top client software vulnerabilities. No surprises on most of these… error handling, buffer issues, SQL injection and so on.
“more code, more bugs, more security problems”

6. OWASP (Open Web Application Security Project)
Vulnerabilities – Web Services
OWASP (Open Web Application Security Project)
1 – Injection
2 – Broken Authentication & Session Management
3 – Cross Site Scripting (XSS)
4 – Insecure Direct Object References
5 – Security Misconfiguration
6 – Sensitive Data Exposure
7 – Missing Functions Level Access Control
8 – Cross Site Request Forgery
9 – Using Components with Known Vulnerabilities
10 – Unvalidated Redirects and Forwards
Web Services have a different set of vulnerabilities – areas you need to consider and address to deliver a secure web service to your customers.

7. Common Vulnerabilities
Tying together various web services – a lot of what we talked about today – has its own special security requirements – the importance of Filter Input and Escape Pitput.

8. What you should do right now
Limit user privileges
Turning on compiler/linker security flags
Disabling unsafe functions by using banned.h
So what is it that you as a developer can do right away to secure your applications?
Here are three things that you can do right away. First, limit the user privileges of your application. This will automatically reduce the risk of damage that your application can do.
The next thing you could do is to turn on the flags that your compiler and linker provides that will detect and report potential security holes in your application. All modern compilers have these flags and using all of them is the right thing to do.
Third, most legacy code, especially in C and C++, uses standard library methods and functions that make your applications vulnerable to hacking and attacks. You should immediately swap these functions and methods out for more secure versions of these methods and functions.

9. What Autodesk is doing
Implementing infrastructure and processes to secure all applications spanning
Desktop
Mobile
Cloud
Autodesk is constantly working on improving processes to strengthen existing security modules in its applications and introduce newer practices as they evolve. We are actively conducting Audits of our applications to identify vulnerabilities and plugging them. These Audits and standard improvements span multiple platforms including desktop, mobile and cloud based services.

10. Autodesk on the cloud Physical security at cloud data centers
Software security schemes at multiple levels
Securing access to your content
Encrypting transmitted data
On the cloud, Autodesk has established clear policy practices to secure your Intellectual property. Here is what we implement:
A very high level of physical security of the data centers in which the cloud data exists
Software security schemes at multiple levels from the low level operating systems all the way up to the software application that you use.
Securing access to your content through login/password mechanism. The process of logging-in itself is also encrypted.
Encrypting any data that is transmitted from your local computer to the cloud and vice versa

11. Autodesk Security Policy and Practices
Autodesk® 360: Work Wherever You Are – Safely
Autodesk Trust Center
One of the key focus points in the previous slide is application security and while it is mainly your responsibility to secure your application, the Autodesk cloud infrastructure goes to great lengths to secure it as well. These issues are discussed in more detail in this white paper from Autodesk: Autodesk® 360: Work Wherever You Are – Safely. You will also find more technical details in the links provided here.
Also, the Autodesk Trust Center will give you up to date information on Privacy, Security, Operational and Quality control measures for Autodesk products and services. There is a lot of information here that will equip you to have a rational and informed discussion with your customers about security issues.

12. More Autodesk Security Info
Security Controls for the Autodesk® 360 Managed Services
Terms of Service: Autodesk® 360 and Other Services
You might also worry about details of how your data, and that of your customer, is handled once it is on the cloud. For instance what happens if you or your customer deletes the content? Do backups exist? Who else has access to your data if any? What happens when an account is terminated? These details and more are specifically discussed here: Terms of Service: Autodesk® 360 and Other Services. The Terms of service is not just a legal document. It also gives specific details of how the data is handled. It is highly recommended that you read these documents.

13. Questions and Answers

14. Autodesk is a registered trademark of Autodesk, Inc
Autodesk is a registered trademark of Autodesk, Inc., and/or its subsidiaries and/or affiliates in the USA and/or other countries. All other brand names, product names, or trademarks belong to their respective holders. Autodesk reserves the right to alter product and services offerings, and specifications and pricing at any time without notice, and is not responsible for typographical or graphical errors that may appear in this document.