This document provides an overview of authentication and security mechanisms in ASP.NET web applications. It discusses the .NET security model, including the Common Language Runtime (CLR) which provides an additional layer of security on top of core OS security. It also covers ASP.NET web application security configurations like permissions, roles, and authentication methods. Configuring options in the web.config file and machine.config file allows enforcing security policies for web applications.
This document discusses various network security mechanisms including firewalls, intrusion detection systems, encryption, authentication, and wireless security. It covers Cisco router security strategies for the different network planes (data, control, management, service). It also discusses Windows server security topics such as centralized user authentication, group policy, and the roles of DNS, DHCP, FTP, VPN, and ISA servers. Wireless security standards, topologies, and attacks are explained as well as protocols like WEP, WPA, and WPA2.
The document discusses scalability, availability, performance, and reliability as key aspects of system architecture. It describes vertical and horizontal scaling approaches. Security topics covered include cyber security frameworks, protecting people, processes, and technology, and specific areas like application security, cloud security, cryptography, infrastructure security, incident response, and vulnerability management. The goal of architecture is to minimize human resources needed for development and maintenance.
Active Directory is a directory service developed by Microsoft for Windows domain networks. A domain controller running Active Directory Domain Services authenticates and authorizes all users and computers in the domain, enforcing security policies. Active Directory consists of a database and code that maintains user and system information for the domain.
This document discusses database system security and outlines several key areas to focus on:
1. Secure the database itself by managing users, passwords, privileges and roles.
2. Secure the database management system (DBMS) by patching known vulnerabilities and controlling access to system files and directories.
3. Secure applications that interface with the database to prevent attacks like SQL injection.
It also briefly outlines the importance of securing the operating system, web server, and network environment that interact with the database system. A lab exercise is proposed to examine security in these different areas of an Oracle database deployment.
Spring Security is a powerful and highly customizable authentication and access-control framework. It is the de-facto standard for securing Spring-based applications.
SysAdm is a BSD-licensed framework for administering FreeBSD/TrueOS systems locally or remotely. It includes a server that runs on managed systems and provides an API, a client with graphical utilities, and an experimental bridge. The server uses JSON over REST or WebSockets and requires authentication. The client accesses server APIs and provides notifications. The bridge allows connections to systems behind firewalls.
Connection String Parameter Pollution AttacksChema Alonso
Paper about Connection String Attacks that focus in Connection String Parameter Pollution in Web Applications. Presented in Ekoparty 2009, Black Hat DC 2010 and Troopers 2010
This document proposes a new middleware architecture called ISO-WSP to address security issues in current web service platforms (WSPs). ISO-WSP decomposes WSPs into two parts running in separate protection domains: (1) a small trusted T-WSP that handles security-sensitive data, and (2) a large untrusted U-WSP that provides normal WSP functionality but uses T-WSP for security tasks. This reduces complexity of trusted code and improves security. ISO-WSP also splits applications into trusted and untrusted parts, isolating access to sensitive data through a secure interface. The authors implemented a prototype using Apache Axis2 and found it reduced trusted software complexity five-fold with modest performance
This document discusses various network security mechanisms including firewalls, intrusion detection systems, encryption, authentication, and wireless security. It covers Cisco router security strategies for the different network planes (data, control, management, service). It also discusses Windows server security topics such as centralized user authentication, group policy, and the roles of DNS, DHCP, FTP, VPN, and ISA servers. Wireless security standards, topologies, and attacks are explained as well as protocols like WEP, WPA, and WPA2.
The document discusses scalability, availability, performance, and reliability as key aspects of system architecture. It describes vertical and horizontal scaling approaches. Security topics covered include cyber security frameworks, protecting people, processes, and technology, and specific areas like application security, cloud security, cryptography, infrastructure security, incident response, and vulnerability management. The goal of architecture is to minimize human resources needed for development and maintenance.
Active Directory is a directory service developed by Microsoft for Windows domain networks. A domain controller running Active Directory Domain Services authenticates and authorizes all users and computers in the domain, enforcing security policies. Active Directory consists of a database and code that maintains user and system information for the domain.
This document discusses database system security and outlines several key areas to focus on:
1. Secure the database itself by managing users, passwords, privileges and roles.
2. Secure the database management system (DBMS) by patching known vulnerabilities and controlling access to system files and directories.
3. Secure applications that interface with the database to prevent attacks like SQL injection.
It also briefly outlines the importance of securing the operating system, web server, and network environment that interact with the database system. A lab exercise is proposed to examine security in these different areas of an Oracle database deployment.
Spring Security is a powerful and highly customizable authentication and access-control framework. It is the de-facto standard for securing Spring-based applications.
SysAdm is a BSD-licensed framework for administering FreeBSD/TrueOS systems locally or remotely. It includes a server that runs on managed systems and provides an API, a client with graphical utilities, and an experimental bridge. The server uses JSON over REST or WebSockets and requires authentication. The client accesses server APIs and provides notifications. The bridge allows connections to systems behind firewalls.
Connection String Parameter Pollution AttacksChema Alonso
Paper about Connection String Attacks that focus in Connection String Parameter Pollution in Web Applications. Presented in Ekoparty 2009, Black Hat DC 2010 and Troopers 2010
This document proposes a new middleware architecture called ISO-WSP to address security issues in current web service platforms (WSPs). ISO-WSP decomposes WSPs into two parts running in separate protection domains: (1) a small trusted T-WSP that handles security-sensitive data, and (2) a large untrusted U-WSP that provides normal WSP functionality but uses T-WSP for security tasks. This reduces complexity of trusted code and improves security. ISO-WSP also splits applications into trusted and untrusted parts, isolating access to sensitive data through a secure interface. The authors implemented a prototype using Apache Axis2 and found it reduced trusted software complexity five-fold with modest performance
FreeBSD System Administration Using SysAdmDru Lavigne
The SysAdm framework provides a suite of tools for remotely managing FreeBSD and TrueOS systems. It includes a server component that runs on managed systems and exposes an API. It also includes a graphical client for connecting to servers and performing administration tasks. The client integrates with the system tray and supports notifications. The framework is designed to securely manage multiple remote systems and complement existing FreeBSD configuration methods.
Prevention of SQL Injection Attacks having XML DatabaseIOSR Journals
This document discusses an XML-based technique called XML-SQL for preventing SQL injection attacks. It proposes submitting all client data to the server in an XML format and having the server validate the entire XML file against pre-defined validation rules at once, rather than validating each data item separately. This allows complex data to be validated more easily and generically. The technique aims to separate the data validation from the application development to make the developer's job simpler and more secure.
OS command injection vulnerabilities occur when user input is not sanitized before being passed to a shell command interpreter. This allows attackers to inject arbitrary commands that will be executed by the server, potentially compromising the server or application data. Command injection vulnerabilities are serious because they may enable attackers to use the server as a platform for launching attacks against other systems. Commix is an open source tool that can detect and exploit command injection vulnerabilities.
The document discusses security concerns related to hacking Novell Netware networks. It covers common default accounts and passwords in Netware that can be exploited, such as the supervisor account. It also describes various password cracking and hacking tools that can be used to attack Netware systems, such as password crackers, and tools to access password files, spoof logs, and conduct denial of service attacks. Finally, it discusses recommended practices for hardening Netware server settings to help prevent attacks.
SysAdm: Simplifying FreeBSD AdministrationKen Moore
SysAdm is a new tool created by TrueOS developers for administering FreeBSD systems. It consists of a SysAdm Server that runs on FreeBSD, a cross-platform SysAdm Client, and a bridge (still in development). The server facilitates interactions between the user and system directly without an internal database. The client allows graphically managing multiple servers with features like package management, firewall configuration, and system monitoring. Both components use encryption and authentication to communicate securely. SysAdm aims to simplify administration tasks without replacing traditional SSH/terminal access.
SQL Server 2005 introduced enhancements to security including:
1. Authentication can specify SSL or mutual authentication with client certificates. Authorization establishes login credentials and permissions within a database.
2. A new security model separates users from schemas, allowing dropping a user without breaking applications. Users have a default schema and objects are contained within schemas.
3. Cryptography support provides encryption, decryption, signing and verification functions including symmetric and asymmetric keys. Permissions in SQL 2005 allow finer-grained control at the row level and module execution context.
Midori is a research operating system project started in 2003 by Microsoft Research to build a highly dependable OS where the kernel, drivers, and applications are written in managed code. It is intended to co-exist with Windows applications and have concurrency as its foundation. Midori uses an asynchronous architecture and will run on various topologies like client-server and cloud data centers using .NET languages. Its goal is to provide a simpler programming model than Windows through decomposing applications into services.
The document discusses Novell iChain, a solution for securing web applications and servers. It provides single sign-on, encrypts data as it passes through proxies, and removes direct access to web servers. It authenticates users through LDAP or certificates and authorizes access through rules stored in eDirectory. This simplifies management and security across multiple web server platforms and applications.
This document provides a summary of Ogbonna Augustine Nwabueze's experience and qualifications. He has over 5 years of experience as a Linux Systems Administrator, working with Red Hat Enterprise Linux, CentOS, Ubuntu, and Oracle Linux. He is certified in VMware Datacenter Virtualization and has a Bachelor's degree in Chemistry. His experience includes system administration, package and file management, logical volume management, security administration, and virtualization.
Current Topics paper A4 submission 4.30.2015 Master CopyTommie Walls
The document summarizes the cyber security testing conducted during the development of a capstone inventory management system for a hospital. A team of students assumed the role of security specialists and tested the system using tools like Nessus, ZAP, SQLMap, and Hydra. Initial tests found some vulnerabilities which were addressed. Further testing found only one remaining issue of the certificate not being from a known authority. The security team recommended the hospital conduct ongoing security testing of the application as it is expanded for additional use.
This document discusses the evolution of LAMP stacks over time from the original LAMP 1.0 to the more modern LAMP 2.0. It outlines some of the key benefits of LAMP such as agility and constant upgrades but also notes newer versions can introduce new exploits. The document then discusses important principles for data security when using LAMP including that security is a process, every component must be secure, and having a threat model. It provides examples of how to configure database security settings like access control, authentication, privileges to restrict data access.
This document provides information on testing Mule applications. It discusses unit testing with the Mule Test Compatibility Kit (TCK) which provides base test classes for testing components like connectors, transformers, and message receivers. It also discusses functional testing using the FunctionalTestCase which runs Mule inside a test case and manages the server lifecycle. The FunctionalTestComponent can help support richer asynchronous tests by simulating asynchronous communication and returning mock data.
LAPP/SELinux - A secure web application stack using SE-PostgreSQLKohei KaiGai
The document discusses a secure web application stack using SELinux and SE-PostgreSQL. It describes how SELinux can act as a conductor to provide system-wide access control consistency. SE-PostgreSQL allows PostgreSQL to make access control decisions based on the centralized SELinux security policy. This ensures least privilege and consistency across application layers compared to traditional stacks that rely on each layer having separate security mechanisms.
The document proposes a desktop security architecture that isolates user data and applications to improve attack resistance. It separates applications into virtual machine appliances with the ability to rollback to known good states. It also proposes using a secured file server in a separate VM, network intrusion detection, and file system intrusion detection enforced through application-specific access contracts. This is intended to limit the impact of attacks and allow faster recovery without system downtime or reboots.
Security Enhanced PostgreSQL - System-wide consistency in access controlKohei KaiGai
This document discusses Security-Enhanced PostgreSQL (SE-PostgreSQL), which provides system-wide consistency in access controls for PostgreSQL. The key developer, KaiGai Kohei, has experience with Linux kernel development and PostgreSQL. SE-PostgreSQL applies a single, unified security policy to information assets regardless of how they are stored, using fine-grained mandatory access controls at the tuple and column level. It aims to prevent data leaks and manipulation through consistent, mandatory access controls.
The document summarizes the skills and experience of Olabintan V Akinsola as a Linux systems administrator. They have over 6 years of experience administering Linux, Windows, and Unix systems and applications such as Oracle, Apache, Tomcat, and Jboss. They are proficient in technologies including AWS, Ansible, Git, and programming languages like Bash, Ruby and YAML.
Functionality mashup via simple filtersDerek Keats
Functionality mashup via simple filters is a talk I gave at the IMS/GLC/University of Michigan summit on The Coming Changes in Learning: Creating New Architectures Now!
This is the first lecture in the iPhone Course in FCI - Cairo University by PiTechnologies
This is part two of the first day about "Introduction to iOS"
This document discusses software security and common vulnerabilities in web applications such as SQL injection and cross-site scripting (XSS). It explains that SQL injection exploits vulnerabilities in database applications by injecting malicious SQL code via user input, while XSS injects client-side scripts by storing malicious code in websites. The document demonstrates how these attacks work and can be used to steal sensitive data or inject malware onto users' computers. It emphasizes the importance of validating, sanitizing, and escaping all user input to prevent such vulnerabilities.
This document is a curriculum vitae for Sean Murphy, a British national born in 1962. It lists his qualifications and extensive work history as a rigging supervisor and rigger, primarily in offshore oil and gas. His qualifications include safety certifications and rigging courses from 1994 to 2013. His employment history details positions from 1987 to the present as a rigger and rigging supervisor on various offshore vessels, installations, and projects around the world.
Michelle Aylene Lee has over 20 years of experience in advanced rigging, scaffolding, and crane operation roles. She has worked on numerous projects in Australia and overseas, including at Ichthys Project in Darwin, Pluto Project in Western Australia, and LNG projects in Karratha. Her resume lists extensive qualifications and licenses, and provides over 20 employment history entries with references.
FreeBSD System Administration Using SysAdmDru Lavigne
The SysAdm framework provides a suite of tools for remotely managing FreeBSD and TrueOS systems. It includes a server component that runs on managed systems and exposes an API. It also includes a graphical client for connecting to servers and performing administration tasks. The client integrates with the system tray and supports notifications. The framework is designed to securely manage multiple remote systems and complement existing FreeBSD configuration methods.
Prevention of SQL Injection Attacks having XML DatabaseIOSR Journals
This document discusses an XML-based technique called XML-SQL for preventing SQL injection attacks. It proposes submitting all client data to the server in an XML format and having the server validate the entire XML file against pre-defined validation rules at once, rather than validating each data item separately. This allows complex data to be validated more easily and generically. The technique aims to separate the data validation from the application development to make the developer's job simpler and more secure.
OS command injection vulnerabilities occur when user input is not sanitized before being passed to a shell command interpreter. This allows attackers to inject arbitrary commands that will be executed by the server, potentially compromising the server or application data. Command injection vulnerabilities are serious because they may enable attackers to use the server as a platform for launching attacks against other systems. Commix is an open source tool that can detect and exploit command injection vulnerabilities.
The document discusses security concerns related to hacking Novell Netware networks. It covers common default accounts and passwords in Netware that can be exploited, such as the supervisor account. It also describes various password cracking and hacking tools that can be used to attack Netware systems, such as password crackers, and tools to access password files, spoof logs, and conduct denial of service attacks. Finally, it discusses recommended practices for hardening Netware server settings to help prevent attacks.
SysAdm: Simplifying FreeBSD AdministrationKen Moore
SysAdm is a new tool created by TrueOS developers for administering FreeBSD systems. It consists of a SysAdm Server that runs on FreeBSD, a cross-platform SysAdm Client, and a bridge (still in development). The server facilitates interactions between the user and system directly without an internal database. The client allows graphically managing multiple servers with features like package management, firewall configuration, and system monitoring. Both components use encryption and authentication to communicate securely. SysAdm aims to simplify administration tasks without replacing traditional SSH/terminal access.
SQL Server 2005 introduced enhancements to security including:
1. Authentication can specify SSL or mutual authentication with client certificates. Authorization establishes login credentials and permissions within a database.
2. A new security model separates users from schemas, allowing dropping a user without breaking applications. Users have a default schema and objects are contained within schemas.
3. Cryptography support provides encryption, decryption, signing and verification functions including symmetric and asymmetric keys. Permissions in SQL 2005 allow finer-grained control at the row level and module execution context.
Midori is a research operating system project started in 2003 by Microsoft Research to build a highly dependable OS where the kernel, drivers, and applications are written in managed code. It is intended to co-exist with Windows applications and have concurrency as its foundation. Midori uses an asynchronous architecture and will run on various topologies like client-server and cloud data centers using .NET languages. Its goal is to provide a simpler programming model than Windows through decomposing applications into services.
The document discusses Novell iChain, a solution for securing web applications and servers. It provides single sign-on, encrypts data as it passes through proxies, and removes direct access to web servers. It authenticates users through LDAP or certificates and authorizes access through rules stored in eDirectory. This simplifies management and security across multiple web server platforms and applications.
This document provides a summary of Ogbonna Augustine Nwabueze's experience and qualifications. He has over 5 years of experience as a Linux Systems Administrator, working with Red Hat Enterprise Linux, CentOS, Ubuntu, and Oracle Linux. He is certified in VMware Datacenter Virtualization and has a Bachelor's degree in Chemistry. His experience includes system administration, package and file management, logical volume management, security administration, and virtualization.
Current Topics paper A4 submission 4.30.2015 Master CopyTommie Walls
The document summarizes the cyber security testing conducted during the development of a capstone inventory management system for a hospital. A team of students assumed the role of security specialists and tested the system using tools like Nessus, ZAP, SQLMap, and Hydra. Initial tests found some vulnerabilities which were addressed. Further testing found only one remaining issue of the certificate not being from a known authority. The security team recommended the hospital conduct ongoing security testing of the application as it is expanded for additional use.
This document discusses the evolution of LAMP stacks over time from the original LAMP 1.0 to the more modern LAMP 2.0. It outlines some of the key benefits of LAMP such as agility and constant upgrades but also notes newer versions can introduce new exploits. The document then discusses important principles for data security when using LAMP including that security is a process, every component must be secure, and having a threat model. It provides examples of how to configure database security settings like access control, authentication, privileges to restrict data access.
This document provides information on testing Mule applications. It discusses unit testing with the Mule Test Compatibility Kit (TCK) which provides base test classes for testing components like connectors, transformers, and message receivers. It also discusses functional testing using the FunctionalTestCase which runs Mule inside a test case and manages the server lifecycle. The FunctionalTestComponent can help support richer asynchronous tests by simulating asynchronous communication and returning mock data.
LAPP/SELinux - A secure web application stack using SE-PostgreSQLKohei KaiGai
The document discusses a secure web application stack using SELinux and SE-PostgreSQL. It describes how SELinux can act as a conductor to provide system-wide access control consistency. SE-PostgreSQL allows PostgreSQL to make access control decisions based on the centralized SELinux security policy. This ensures least privilege and consistency across application layers compared to traditional stacks that rely on each layer having separate security mechanisms.
The document proposes a desktop security architecture that isolates user data and applications to improve attack resistance. It separates applications into virtual machine appliances with the ability to rollback to known good states. It also proposes using a secured file server in a separate VM, network intrusion detection, and file system intrusion detection enforced through application-specific access contracts. This is intended to limit the impact of attacks and allow faster recovery without system downtime or reboots.
Security Enhanced PostgreSQL - System-wide consistency in access controlKohei KaiGai
This document discusses Security-Enhanced PostgreSQL (SE-PostgreSQL), which provides system-wide consistency in access controls for PostgreSQL. The key developer, KaiGai Kohei, has experience with Linux kernel development and PostgreSQL. SE-PostgreSQL applies a single, unified security policy to information assets regardless of how they are stored, using fine-grained mandatory access controls at the tuple and column level. It aims to prevent data leaks and manipulation through consistent, mandatory access controls.
The document summarizes the skills and experience of Olabintan V Akinsola as a Linux systems administrator. They have over 6 years of experience administering Linux, Windows, and Unix systems and applications such as Oracle, Apache, Tomcat, and Jboss. They are proficient in technologies including AWS, Ansible, Git, and programming languages like Bash, Ruby and YAML.
Functionality mashup via simple filtersDerek Keats
Functionality mashup via simple filters is a talk I gave at the IMS/GLC/University of Michigan summit on The Coming Changes in Learning: Creating New Architectures Now!
This is the first lecture in the iPhone Course in FCI - Cairo University by PiTechnologies
This is part two of the first day about "Introduction to iOS"
This document discusses software security and common vulnerabilities in web applications such as SQL injection and cross-site scripting (XSS). It explains that SQL injection exploits vulnerabilities in database applications by injecting malicious SQL code via user input, while XSS injects client-side scripts by storing malicious code in websites. The document demonstrates how these attacks work and can be used to steal sensitive data or inject malware onto users' computers. It emphasizes the importance of validating, sanitizing, and escaping all user input to prevent such vulnerabilities.
This document is a curriculum vitae for Sean Murphy, a British national born in 1962. It lists his qualifications and extensive work history as a rigging supervisor and rigger, primarily in offshore oil and gas. His qualifications include safety certifications and rigging courses from 1994 to 2013. His employment history details positions from 1987 to the present as a rigger and rigging supervisor on various offshore vessels, installations, and projects around the world.
Michelle Aylene Lee has over 20 years of experience in advanced rigging, scaffolding, and crane operation roles. She has worked on numerous projects in Australia and overseas, including at Ichthys Project in Darwin, Pluto Project in Western Australia, and LNG projects in Karratha. Her resume lists extensive qualifications and licenses, and provides over 20 employment history entries with references.
Fred Kurth has over 15 years of experience in mechanical fitting, rigging, and valve technician roles. He has worked on various projects including at power stations, oil refineries, and mining sites. Kurth holds qualifications in engineering trades, business management, and licenses for operating machinery. He provides references from four previous supervisors.
Amod Kumar Puri is applying for the position of Rigging & Lifting Supervisor. He has over 20 years of experience in rigging, lifting, and project management roles in the oil, gas, and chemical industries. Currently he is working as a Rigging & Lifting Supervisor for the Yamal LNG Project in China, where his responsibilities include supervising rigging and lifting operations, ensuring safety compliance, and coordinating with contractors. He is seeking new challenges in project management or commissioning with a growth-oriented company.
- Marc Paul Bayliss is an experienced rigger and scaffolder seeking new opportunities. He has over 15 years of experience in rigging, scaffolding, and related fields in Australia, New Zealand, and the UK. His experience includes work on various mining and construction projects. He has the required licenses and certifications and lists several former supervisors as references.
Michael Martinez Sr. has over 20 years of experience as a heavy equipment operator, rigger, crane operator, and mechanic. He has worked for several companies at Sherwin Alumina Co. performing duties like operating cranes up to 60 tons, heavy machinery, rigging, boiler maintenance, and assisting with production and maintenance tasks. He is skilled in a variety of equipment and aims to perform his duties properly and exceed expectations.
Ernest Hodgins has over 20 years of experience working in rigging roles within the oil and gas industry, both onshore and offshore. He has worked on numerous projects in locations such as the North Sea, Brazil, Ghana, and Qatar. Hodgins is skilled in tasks such as mobilizing and demobilizing equipment, installing and replacing pipelines and valves, and ensuring all work is performed safely and to a high standard. He has extensive safety and technical training qualifications.
Michael Martinez has over 15 years of experience in heavy equipment operations, refinery process operations, and supervision. He is MSHA certified and holds a current TWIC card. His experience includes operating and maintaining heavy equipment, operating refinery and production processes, supervising refinery operations and maintenance, and coordinating safety activities. He is seeking new opportunities in heavy equipment operation, refinery process operation, or field supervision.
Ralph Halliday has over 25 years of experience in construction, mining, and offshore oil and gas industries. He has worked as an advanced rigger, dogman, crane operator, and construction supervisor on various projects in Australia and Africa. He holds several high risk work licenses and qualifications. References are available from his current employer CB&I Kentz and past supervisors.
This document contains contact information and a resume for Amod Kumar Puri, who is seeking a position as a Lifting & Rigging Supervisor. He has over 20 years of experience in construction and engineering in the oil and gas industry. Currently he works as a Rigging and Lifting Supervisor for Technip in China, overseeing lifting activities and equipment installation. His experience includes roles in Qatar, Russia, India, and other locations supervising rigging, lifting, module installation, and heavy transportation tasks. He has the required certifications and seeks to join an organization where he can continue utilizing his skills in a safety-focused manner.
Carl Hinds has over 34 years of experience in offshore rigging and lifting activities in the oil and gas industry. He has worked in roles such as rigger, deck foreman, and lifting coordinator on offshore platforms and vessels. Hinds has extensive experience in lift planning, rigging operations, and project management. He possesses relevant certifications including LOLER Focal Point, Rigger Level 4, and OPITO qualifications.
Brian Timpson's curriculum vitae provides details of his experience as a deck foreman and rigging supervisor over 35 years. It lists his qualifications, medical certifications, safety training, offshore experience on numerous oil rigs and vessels in locations around the world, and onshore experience in refineries and industrial plants. The CV details his contact information, licenses, inoculations, and extensive experience planning and overseeing rigging operations.
Len Kingi is an experienced rigger seeking a job back with Monadelphous. He has over 10 years of experience working on various projects in Western Australia, including with CB&I, Monadelphous, UGL, and Amec Services. His skills include advanced rigging, dogman work, crane and telehandler operation, confined space entry, and working at heights. He has a valid work safe card, driver's license, and various certifications. Kingi has worked on projects in Barrow Island, Tom Price, Port Hedland, Worsley, and more. He is a hard worker focused on safety who has experience working independently and as part of a team.
CRM is not software. It is your business strategy, your business model, your student experience at your school brand. What's required therefore is a planned approach to transform your business model so that CRM tools such as Salesforce can better support your go-to market business goals.
O documento apresenta as ementas semanais do Jardim-de-Infância Patronato Nossa Senhora da Bonança em Vila Praia de Âncora, contendo os suplementos, almoços, lanches e reforços de cada dia, para as semanas de 30 de janeiro a 03 de março de 2017.
This document provides guidance for setting goals with girls aged 10 and up. It recommends introducing the topic of goals and the importance of setting them. It distinguishes between dreams and goals, with goals being more concrete and achievable. The activity teaches girls to break down goals into smaller, attainable steps organized by level of risk or challenge. This allows big goals to feel less daunting by dividing them into steps in one's comfort zone, low risk zone, and high risk zone. The document includes materials for leading a 30-40 minute session with girls to define a dream, set a related goal, identify steps, and commit to their first step.
Peter Gostling is an experienced manager in the transport and logistics sector with over 35 years of experience. He has held various managerial roles at several large transport and logistics companies, including Wincanton Transport Services, where he currently serves as General Manager, and Fowler Welch Coolchain, where he was previously Business Development Manager and General Manager. Gostling has expertise in areas such as customer service, financial management, business development, and people management.
2017 Silicon Valley Investment Trends by Edith Yeung Edith Yeung
This document summarizes 8 major technology trends in Silicon Valley for 2017 according to Edith Yeung. The trends include: 1) increased investment and focus on artificial intelligence applications, 2) growth of voice assistants like Alexa and Google Home, 3) continued growth of virtual and augmented reality but slower investment, 4) increased funding and applications of robotics, 5) personalized healthcare through data and genomics, 6) competition to develop autonomous vehicles, 7) development of synthetic foods, and 8) growth of cross-border startups especially between China and the US. Edith Yeung is the head of 500 Startups Greater China fund and has invested in over 35 AI, VR and robotics startups in the last 2 years.
“.NET IS A SET OF TECHNOLOGIES DESIGNED TO ALLOW APPLICATIONS TO WORK TOGETHER WHETHER THEY RESIDE ON THE USER’S HARD DRIVE, THE LOCAL NETWORK, A REMOTE COMPUTER, OR THE INTERNET.”
The Microsoft. NET strategy was presented by Microsoft officials in June 2000:
.NET is Microsoft's new Internet and Web strategy
.NET is NOT a new operating system
.NET is a new Internet and Web based infrastructure
.NET delivers software as Web Services
.NET is a framework for universal services
.NET is a server centric computing model
.NET will run in any browser on any platform
.NET is based on the newest Web standards
Because .NET applies to almost all Microsoft products, the company divides .NET into several areas including .NET servers and the .NET Framework.
The .NET servers provide services to client applications or other services. For example, Microsoft SQL Server 2000 provides relational database management system (RDBMS) services.
“THE .NET FRAMEWORK IS A COMMON ENVIRONMENT FOR BUILDING, DEPLOYING, AND RUNNING WEB SERVICES AND WEB APPLICATIONS.”
The .NET Framework contains common class libraries - like ADO.NET, ASP.NET and Windows Forms - to provide advanced standard services that can be integrated into a variety of computer systems.
The .NET Framework is language neutral. Currently it supports C++, C#, Visual Basic, JScript (The Microsoft version of JavaScript) and COBOL. Third-party languages - like Eiffel, Perl, Python, Smalltalk, and others - will also be available for building future .NET Framework applications.
Protecting location privacy in sensor networks against a global eavesdropperShakas Technologies
The document discusses techniques for providing location privacy in sensor networks against a global eavesdropper. It proposes four techniques - periodic collection, source simulation, sink simulation, and backbone flooding - to provide location privacy for monitored objects (source location privacy) and data sinks (sink location privacy). These techniques provide trade-offs between privacy, communication cost, and latency. Analysis and simulation demonstrate that the proposed techniques are efficient and effective for providing source and sink location privacy in sensor networks.
The document describes a travel agency management system that offers the following key features:
- Integrated travel agents located directly in companies to make reservations and issue tickets.
- An electronic booking system that is IATA approved along with state-of-the-art technology.
- Dedicated and bilingual staff that provide personalized service and account management for corporate travel needs.
- One-stop shopping for all travel arrangements along with corporate agreements with airlines.
Distributed Systems Architecture in Software Engineering SE11koolkampus
Distributed systems architectures allow software to execute across multiple processors. Key approaches include client-server systems and distributed object architectures. Client-server divides an application into client and server components, while distributed object architectures treat all entities as objects that provide and consume services. Middleware like CORBA supports object communication and common services.
This document provides an overview of key concepts in distributed systems including:
1) A distributed system is defined as a collection of independent components that communicate and coordinate their actions by passing messages, appearing as a single coherent system to users.
2) Examples of distributed systems include the Internet, intranets, mobile computing systems, and ubiquitous computing devices. Distributed systems face challenges related to concurrency, failures, scalability, heterogeneity, security and transparency.
3) The document discusses several examples of distributed systems in detail, including the World Wide Web which allows sharing of documents and services via HTTP, URLs, HTML and web servers/browsers. Client-server interaction and dynamic content are also described.
The document discusses a system analysis of a cloud storage security system. It analyzes the current system and requirements to specify a new system. A feasibility study is then conducted to determine if the new system is worth developing. The feasibility study examines operational feasibility like whether the system will be used and supported. It also looks at technical feasibility to ensure the necessary technology exists and financial/economic feasibility to determine if it provides benefits without requiring additional resources. Finally, the document describes the proposed new system which has modules for the graphical user interface, authentication/authorization, connection management, and security implementation.
The document proposes a cloud environment for backup and data storage using remote servers that can be accessed through the Internet. It involves using the disks of cluster nodes as a global storage system with PVFS2 parallel file system for improved performance. The proposed system aims to increase data availability and reduce information loss by storing data on a private cloud using PVFS2 and developing a multiplatform client application for fast data transfer. It allows reuse of existing infrastructure to reduce costs and gives users experience of managing a private cloud.
Dairy management system project report..pdfKamal Acharya
ASP.NET is the next version of Active Server Pages (ASP); it is a unified Web development platform that provides the services necessary for developers to build enterprise-class Web applications. While ASP.NET is largely syntax compatible, it also provides a new programming model and infrastructure for more secure, scalable, and stable applications. ASP.NET is a compiled, NET-based environment, we can author applications in any .NET compatible language, including Visual Basic .NET, C#, and JScript .NET. Additionally, the entire .NET Framework is available to any ASP.NET application. Developers can easily access the benefits of these technologies, which include the managed common language runtime environment (CLR), type safety, inheritance, and so on. ASP.NET has been designed to work seamlessly with WYSIWYG HTML editors and other programming tools, including Microsoft Visual Studio .NET. Not only does this make Web development easier, but it also provides all the benefits that these tools have to offer, including a GUI that developers can use to drop server controls onto a Web page and fully integrated debugging support.
Distributed systems have several architectures including client-server, distributed objects, peer-to-peer, and service-oriented. Client-server divides systems into clients that request services and servers that provide services. Distributed object architectures treat all entities as objects that provide and use services. Peer-to-peer systems are decentralized with no clients or servers, while service-oriented systems are built by linking services from different providers. Middleware like CORBA supports communication between distributed components.
The .NET Framework is a development platform that allows building and running applications and web services on Windows. It includes common language runtime, class libraries, and compilers that generate intermediate language code. The common language runtime manages memory and executes the code, providing services like automatic memory management and security. It supports multiple programming languages and cross-language integration.
The document provides an introduction to Java Enterprise Edition (Java EE). It discusses key concepts such as distributed systems, middleware, the Java EE platform, and Java EE application servers. The Java EE platform consists of the Java SE APIs, Java EE APIs, and a Java EE application server. Applications are built using Java EE components like EJBs and servlets that run within a managed environment provided by the application server.
This document contains a list of probable questions related to operating systems, file systems, networking, Windows commands, and troubleshooting. Some of the topics covered include types of operating systems, differences between FAT and NTFS file systems, Active Directory, firewall types, OSI model layers, and RAID levels. The list provides definitions and explanations for many common computer and networking concepts.
The document lists several probable questions about operating systems and computer security topics. It includes definitions and comparisons of different types of operating systems like real-time, multi-user, multi-tasking, distributed, and embedded operating systems. It also summarizes the differences between FAT and NTFS file systems, enhancements in Windows 2003, defines what an active directory is, describes types of firewalls like network-level, circuit-level, application-level, and stateful multi-level firewalls, and compares hardware and software firewalls.
The .NET Framework is a software framework developed by Microsoft that runs primarily on Microsoft Windows. It includes a large class library called Framework Class Library and provides language interoperability across multiple programming languages. Programs written for .NET execute under the Common Language Runtime (CLR) which provides important runtime services like memory management, security, and exception handling. The .NET Framework is intended for most new applications created on Windows platforms.
Net framework key components - By Senthil Chinnakondatalenttransform
This document provides information on the history and key components of the .NET Framework as well as new features introduced in version 4.5. It began with version 1.0 in 2002 and the latest version is 4.5.2. The .NET Framework includes the Common Language Runtime (CLR) which manages code execution, the Common Type System (CTS) which defines supported data types, and garbage collection for automatic memory management. Version 4.5 introduced improvements such as larger array support, background garbage collection, and regular expression matching timeouts. The document also summarizes WCF concepts like contracts and bindings and describes transport, message, and transport with message credential security options.
The document provides information about .NET Framework interview questions and their answers. Some key points:
1. .NET is a development platform that allows building web, desktop and mobile applications. It includes a programming model, class libraries and runtime environment.
2. The .NET Framework consists of the common language runtime (CLR) and .NET Framework class library. The CLR handles execution and provides services like memory management. The class library contains reusable types.
3. Managed code runs within the CLR. When code is compiled, it is converted to Microsoft intermediate language (MSIL) for execution on any CPU architecture. The just-in-time (JIT) compiler converts MSIL to native code.
1. An ISS X-Force™ White Paper
Authentication and Security Mechanisms in
ASP.NET Web Applications
6303 Barfield Road • Atlanta, GA 30328 Tel: 404.236.2600 • Fax: 404.236.2626
2. Security in ASP.NET Web Applications
Introduction
Microsoft’s .NET framework provides developers with the ability to build and deploy applications
and services via the Web. These services can facilitate communication between clients and .NET
application servers (such as database servers and so forth) through the use of XML queries
issued by the client. This environment is attractive to developers because it is a language-neutral
environment that can deliver content to end-users regardless of the platform in use.
ASP.NET is a part of the framework for developing .NET applications. .NET itself is a model of
software development and delivery envisioned by Microsoft. Its goal is to provide the software,
develpoment platform, and backend infrastructure for applications that can be distributed across
the Internet or other networks to a variety of devices such as Personal Computers (PCs) and
Personal Digital Assistants (PDAs).
Although this technology provides powerful functionality to developers, these services can
represent a potential threat to the security of a Web server. .NET applications and services can
provide potential intruders with a new vector of attack, since many firewalls do not process HTTP
traffic at a sufficient level to recognize malicious activity. Furthermore, these applications can
possibly be used as a gateway for attackers to communicate with the .NET application servers.
This document discusses some of the security mechanisms and configuration options available to
administrators to help secure these applications and reinforce the integrity of the Web server.
Basic Definitions
These basic terms are elements of .NET that are referred to throughout this document:
Common Language Runtime (CLR) – The runtime environment for .NET applications. CLR acts
as a virtual machine and is capable of providing an additional layer of security on top of the core
OS Security mechanisms.
Assemblies – Units of code that combine to form a .NET application. Each assembly can reside
in different places on the computer (or network) and can have different security permissions
applied to them.
The .NET Framework – The framework upon which .NET applications run. The .NET framework
provides the ability for the administrator to configure security policies that can be used by the
CLR when assemblies are being loaded.
Roles – Sets of permissions that may be granted to users by the administrator of a given
computer. Roles provide a convenient method for administrators to specify what access different
classes of users may be given for system resources.
Principals – Represent the identity of the user or agent in which the current thread will execute
on behalf of. Principals are objects that contain an identity of a user and the roles that that user is
assigned to. There are three types of principals ― Windows Principals (for Windows users and
their associated roles), Generic Principals (for users and roles that exist independently of the
operating system’s user database), and Custom Principals (for application developers to define
for use with applications).
Mobile Code – Code to be invoked that may reside anywhere on the network.
Code Groups – A set of rules used by the .NET framework to categorize different assemblies.
Each category has a set of rules defined that dictate what restrictions are applied to its
constituent assemblies.
An ISS X-Force™ White Paper Page 1
3. Security in ASP.NET Web Applications
Evidence – The identification of a given assembly that is used to sort assemblies into code
groups. Evidence is information pertaining to a particular assembly including where it originated
from, the author, and if the assembly has been cryptographically signed.
Managed Code – .NET assemblies that require the CLR in order to be executed. Code that is
unmanaged is native to the operating system and doesn’t make use of the CLR.
The .NET Security Model
The .NET Security model is a complex, multi-layered, and highly configurable system. Since part
of the purpose of the .NET framework is to allow for “mobile code” to be distributed to users on
multiple platforms, security has become a major concern. Mobile code is an application or piece
of software that is transmitted from a server to a local system (or other device) to be executed
locally. This section provides an overview of several aspects of the .NET security model. The
focus for this section is on the configuration of .NET, specifically the configuration options for
securing deployment of Web applications. Configurations of the framework itself, such as defining
policies and code groups, as well as security features inherent in the CLR are addressed later in
this paper.
The Common Language Runtime
Web applications are executed within the CLR environment. This environment incorporates a rich
security infrastructure that is highly configurable and can be tailored by administrators for various
applications.
The CLR security model is completely abstracted from the operating systems’ security
mechanisms, which allows a developer or administrator to define resources that can be accessed
regardless of a system’s user accounts and permissions. This approach is a deliberate design
consideration that allows the .NET runtime to authenticate users using a variety of user-defined
methods. This allows authenticated transactions in a safe environment for a particular Web
application without having specific user accounts defined on the system.
The CLR incorporates the notion of a principal, which is a user or identity that defines a set of
roles and permissions enforced upon the running process. When a Microsoft Internet Information
Server (IIS) receives a request for a Web application, IIS passes control to an ISAPI filter
(ASPNET_ISAPI.DLL), which spawns a worker process (ASPNET_WP.EXE) to execute the
application within the CLR. The worker process thread is assigned a system principal that will
determine what external resources the application may access, such as files on the system. The
CLR also has its own principal that is independent of the OS. The application will use this
principal to determine whether certain resources within the application itself may be accessed or
executed.
As an example, an application needs to access a data file. This file is only readable by the user
‘BOB’ that exists on the system. When this application executes, the OS assigns the worker
process thread the principal BOB (or permissions from an administrative account, but using this
account is bad practice). The application authenticates remote requests against a set of users
that are particular to the application ― the user information does not physically exist on the
system. The application can set the principal that the CLR recognizes to the authenticated user
name so that only certain authenticated users may access the data file.
Later, this paper discusses several configuration parameters that affect operating system
permissions (specifically, the principal permissions that the application will run with when the
application is executed), whereas others affect the CLR principals.
An ISS X-Force™ White Paper Page 2
4. Security in ASP.NET Web Applications
Web Application Security
There are several important features available for configuration for ASP.NET applications.
Permissions for Web applications are regulated by the .NET Framework. Each Web application is
comprised of a number of assemblies, all of which may have different security permissions
granted to them by the CLR. The way these permissions are established is determined by the
configuration of the .NET Framework on the server that is executing these applications.
When building Web applications, configuration options may provide additional security beyond
default settings. These options provide authentication mechanisms and authorization control to
allow for granular support over who may use these applications and what features of the
application are available to that user. System-wide policies may also be put in place to enforce
rules that will apply to all installed Web applications.
These options are configured by changing the configuration parameters in the Web applications’
configuration file, which is located in the directory where the application is installed. This file,
written in XML and named “web.config,” defines a set of policies that will be applied to the
application. The worker process will also recursively examine parent directories for the existence
of web.config files. Lists of permissions will be built from policies supplied in each web.config file
encountered in the order that they are read (from the root directory of the application up to the
root directory of the Web server).
Finally, a global configuration file, machine.config, located in the
%SYSTEMROOT%Microsoft.NET(version)CONFIG directory, defines policies that will be
applied to all installed Web applications. Since this policy is read last, all previously read
web.config files will install policies with a higher precedence than those contained in the global
configuration file.
Authentication
Authentication refers to the method used by the server to verify the clients’ identity. This feature
provides methods to authenticate clients via a set of standardized and reusable methods that
require little or no modification. The methods available to developers are:
None – This method does nothing.
Windows Authentication – Attempts to verify users by validating supplied credentials using
authentication methods used by the Windows operating system. This includes NTLM (NT
LanMan) and Kerberos (for systems running versions more current than Windows NT 4.0).
Windows authentication is used by default if no method is explicitly selected.
IIS Authentication – Uses authentication methods provided by the IIS Web server.
Passport Authentication – Verifies users through the use of the Microsoft Passport
authentication server.
Forms Authentication – Allows for application developers to provide a form for authenticating
users in a standardized way. User accounts can be made specific to the application and stored in
the web.config file.
Authorization
Authorization refers to who is allowed to access specific application resources, as opposed to
authentication, which is concerned with verifying the user using one of the aforementioned
mechanisms. The purpose of authorization is to provide an easy method to apply access controls
to Web applications. Authorization can be performed in two different ways:
An ISS X-Force™ White Paper Page 3
5. Security in ASP.NET Web Applications
Users – A user or list of users can be specified that are explicitly allowed or denied from using
the application.
Roles – A role or list of roles can be specified that are explicitly allowed or denied from using the
application. Any user associated with the role will have the appropriate policy applied to them.
Policies written with roles rather than users are preferable, as administration is simplified and
doesn’t need constant updating.
When a user makes a request to a .NET Web application, .NET examines the web.config file in
the application’s directory for authorization policies. .NET examines each preceding directory up
to the virtual root of the Web directory, and appends any additional authorization rules to the list.
Finally, rules residing in the machine.config file are appended to the list. .NET determines access
to the specified resource by iterating through the rules in the order in which they were read and
allows or denies the request based on the first rule that matches the authenticated user.
When using Windows authentication, authorization can be performed using file permissions. If an
application attempts to access a file resource and does not have sufficient permissions, IIS
attempts to authenticate the user to allow access to the resource.
Configuration Syntax
The discussion of some of the security features for ASP.NET applications also requires an
examination of how these mechanisms are used. The following section presents the syntax for
supplying the necessary configuration parameters to Web applications.
Operating System Related Parameters
The operating system controls what external resources the Web application may access by
assigning a principal to the worker process thread. The access associated with the worker
process is derived in one of two ways.
Impersonating accounts – IIS assigns a token to the process with credentials of the requestor
(either IUSR_machine for anonymous requests or some other principal for authenticated
requests).
Default privileges – Another way to assign access is to start a worker process with the default
permissions specified by the operating system (usually the ‘ASPNET’ user).
Impersonating accounts
This tag causes the IIS Web server to hand off a token to the worker process defining the access
privileges of the application. It is usually placed in the machine.config file or in the root web.config
file for an application in the system.web section.
Syntax: <identity impersonate=“true|false” />
Default value: false
Example:
<configuration>
<system.web>
<identity impersonate=”true” />
</system.web>
</configuration>
An ISS X-Force™ White Paper Page 4
6. Security in ASP.NET Web Applications
Default privileges
This tag sets the default identity in which the worker process will run as. This parameter exists in
the machine.config file in the system.web section. Two accounts (SYSTEM and MACHINE),
which may be supplied as username values, do not require a valid password. In these instances,
the password field is set to “Autogenerate”.
Syntax: <processModel enabled=”true|false” username=”username”
password=”password”/>
Default value: MACHINE
Example:
<configuration>
<system.web>
<processModel enabled=”true” username=”BOB”
password=”bobspassword”/>
</system.web>
</configuration>
CLR Related Parameters
The following tags are configuration parameters that are processed by the HttpModules (primarily
UrlAuthorizationModule) and affect what the CLR permits to be executed or accessed.
Authentication tag
The authentication tag sets the authentication method for a given Web application. This tag is
usually placed in the web.config file in the system.web section. Some of the authentication modes
require nested tags that define their behavior. For example, the ‘Forms’ authentication mode has
a nested forms tag shown in the following example.
Syntax: <authentication mode=“None|Forms|Windows|Passport”>
Default value: Windows
Example:
<configuration>
<system.web>
<authentication mode=”Forms”>
<forms loginUrl=”login.aspx” />
</authentication>
</system.web>
</configuration>
Credentials
Sometimes Web applications authenticate using a custom mechanism or via the forms
mechanism shown in the previous example. When this occurs, user credentials can be stored in
the web.config file to authenticate users. The credentials tag specifies in what manner these
credentials will be stored. Examine the user tag later in this section to see how it is used in
conjunction with the credentials tag.
Syntax: <credentials passwordFormat=“Clear|SHA1|MD5”></credentials>
Default value: none
An ISS X-Force™ White Paper Page 5
7. Security in ASP.NET Web Applications
User
The user tag is used in conjunction with the credentials tag described in the previous section.
This tag describes login credentials in the format specified.
Syntax: <user name=“name” password=“password” />
Default value: none
Example:
<configuration>
<system.web>
<authentication mode=”Forms”>
<forms loginUrl=”login.aspx>
<credentials passwordFormat=”Clear”>
<user name=”bob” password=”bobspassword” />
</credentials>
</forms>
</authentication>
</system.web>
</configuration>
Authorization tags
Three tags define authorization parameters related to Web applications. These tags are placed in
either a web.config file or the machine.config file to apply default policies to all applications.
The first tag is the authorization tag, which defines the section where policies can be defined to
allow or deny users or roles. These rules are checked in the order in which they are read.
Syntax: <authorization> </authorization>
Default value: none
The second and third tags are the ‘allow’ and ‘deny’ tags, which have the same syntax.
Syntax: <allow|deny users|roles=“(userlist|roleslist)” />
These two tags can be used to apply an explicit allow or deny policy to either users or roles. The
user or roles list can be in the form of a comma-delimited list of users or roles for which this policy
will apply. The “?” character means “unauthenticated user” and the “*” wildcard means “anyone.”
Example:
<configuration>
<system.web>
<authorization>
<allow users=”bob, john, paul” />
<deny users=”*” />
</authorization>
</system.web>
</configuration>
An ISS X-Force™ White Paper Page 6
8. Security in ASP.NET Web Applications
Figure 1. The machine.config file.
Recommended Configurations
This section lists some example configuration files for both Personal and Intranet .NET
applications. These examples combine a number of features to serve several different types of
applications.
Public .NET Application
This application is a typical public application in which anonymous users are permitted to access
most resources, but are also able to create private accounts with personalized data. Applications
that might be configured in this manner are Web mail applications and shopping carts.
Configuration
This application is stored in c:application. Private data is stored in files in the C:applicationdata
directory. The forms authentication mechanism has been chosen since the application maintains
its own user database. Additionally, administrator accounts are able to configure the application
using scripts in C:applicationconfig.web.
C:applicationweb.config
<configuration>
<system.web>
<!-- authentication section, use a forms based-login -->
<authentication mode=”Forms”>
<forms loginUrl=”login.aspx>
<credentials passwordFormat=”SHA1”>
<user name=”administrator” password=” …” />
An ISS X-Force™ White Paper Page 7
9. Security in ASP.NET Web Applications
<user name=”bob” password=”…” />
<user name=”john” password=”…” />
<user name=”paul” password=”…” />
</credentials>
</forms>
</authentication>
<!--we just want to deny anonymous users -->
<authorization>
<deny user=”?”>
</authorization>
</system.web>
</configuration>
C:applicationdataweb.config
<configuration>
<system.web>
<authorization>
<allow roles=”users” />
<deny roles=”*” />
</authorization>
</system.web>
</configuration>
C:applicationconfigweb.config
<configuration>
<system.web>
<authorization>
<allow roles=”admins” />
<deny roles=”*” />
</authorization>
</system.web>
</configuration>
Intranet .NET Application
An intranet application usually only grants access to employees. The most appropriate form of
authentication is likely to be the Windows authentication method, where users are mapped to
valid Windows accounts. The application is installed in C:intranetapp.
Configuration
C:intranetappweb.config
<configuration>
<system.web>
<authentication mode=”Windows” />
<authorization>
<allow roles=”employees, managers”>
<deny users=”*”>
</authorization>
</system.web>
</configuration>
An ISS X-Force™ White Paper Page 8
10. Security in ASP.NET Web Applications
.NET Framework Security Mechanisms
Role-Based Security
Role-Based security refers to the security context under which an assembly is run. Assemblies
have associated privilege levels that define what resources may be accessed at execution time.
The framework establishes the privileges granted to a particular assembly when authentication
takes place.
The application programmer defines rules related to roles in an XML configuration file, such as
specifing policies which govern privileges the application has when it is invoked, as well as who is
permitted to use it. This is achieved by specifying rules for both authentication and authorization.
Once authenticated and authorized, an Identity is established and associated with the running
assemblies principal. Identities associated with a principal may either be accounts and roles on
the system, or custom identities that are created by the application programmer.
Figure 2. .NET Framework Configuration.
Evidence-Based Security
When an assembly is being prepared for execution, the .NET framework must decide what
resources the application may access. This is accomplished by evaluating the evidence
associated with the assembly and allocating rights based on this evidence.
Evidence refers to the collection of information describing various aspects of the origin of the
assembly. The purpose of this information is to establish the level of trust that should be granted
to the assembly for execution on the local machine. The information present in assemblies
depends on what is known about the assembly in question. Information supplied could include:
Valid Digital Signatures – If an assembly is signed and the signature can be verified, digital
signatures may be used to ensure that the code is trustworthy if it comes from a reputable source.
An ISS X-Force™ White Paper Page 9
11. Security in ASP.NET Web Applications
URL or Site – The origin of assemblies may also help establish some level of trust if the source is
reputable.
Zone – The zone from where the assembly originated can be used to determine whether
privileges should be granted to it. Untrusted zones, such as the Internet in a default setup, have a
low amount of privileges granted to it.
Path – The path where the assembly is physically located on disk is accessible. This may be
useful to lower privileges of assemblies created by particular users or Web applications that will
be serving anonymous requests.
Evidence is used to categorize assemblies into code groups, which refer to the different sets of
evidence given and associated privileges. Each assembly that is going to be executed is
categorized in a code group so that privileges may be determined and applied. After privileges for
an assembly have been discovered, the framework checks what permissions the assembly
requests to function. If assigned less privileges than the assembly requires, it is not run.
Figure 3. Creating a code group.
The permissions refer to what objects may be accessed on the target system. There are a large
number of objects that an assembly may require to perform its function. These objects include
DataAccess, FileIO, DNS, EventLog, and Environment. By default, very low privilege sets are
granted to assemblies originating from unknown authors on the Internet, so malicious applications
cannot make use of the file system or tamper with the Registry.
An ISS X-Force™ White Paper Page 10
12. Security in ASP.NET Web Applications
Figure 4. Creating a permission set by assigning individual permissions.
Figure 5. Permission levels for a specific permission set.
An ISS X-Force™ White Paper Page 11
13. Security in ASP.NET Web Applications
Cryptography
Cryptography is an important feature incorporated into the .NET framework because it provides
programmers with the ability to securely transmit sensitive data. The .NET framework implements
a streams-based encryption layer, which allows data streams to be routed through encryption
objects to produce encrypted output streams. The .NET framework handles automatic generation
of asymmetric key pairs and symmetric shared secrets applied to CryptoStream objects.
.NET supports the following symmetric algorithms, which use the same key for encryption and
decryption:
DES
3DES
RC2
Rijndael/AES
.NET supports the following asymmetric algorithms, which use one key for encryption and
another for decryption, called public and private keys:
RSA
DSA
.NET supports the following hashing algorithms:
MD5
SHA1
SHA256
SHA384
SHA512
.NET also includes some support for X.509 certificates provided to application programmers.
Code Access Security
Code Access is a security mechanism that prevents assemblies from acquiring privileges during
execution. This mechanism addresses the concern that an assembly might invoke a more
privileged assembly and perform a restricted action, allowing malicious programmers to gain
access to unauthorized resources and subvert the policies put in place when evidence was first
evaluated. The Code Access Security (CAS) mechanism prevents such an attack by initiating a
stack walk when an object is demanded.
A stack walk is the process of verifying that each assembly in the call-chain has permissions to
access the object in question. This process prohibits programmers from performing an attack like
the one described above. When a resource is accessed, the application programmer can trigger
this stack walk by using the Demand() method of a Permission object. Stack walks can be
modified in certain ways to allow certain assemblies to bypass stack checking.
Code Verification
Many security vulnerabilities in software are due to malicious users having the ability to influence
the state of the running program and even alter execution flow. The security mechanisms
incorporated in the .NET framework require that the CLR’s state cannot be altered in such a way.
If a malicious assembly were able, for example, to jump to arbitrary locations in memory, it would
have complete control, or have the ability to modify objects in memory.
To combat these problems, assemblies are verified before they are executed. This process
involves ensuring that the assembly is type safe. Type safety verifies that assemblies do not
assign variables of different data types to each other or perform evaluations of different types of
An ISS X-Force™ White Paper Page 12
14. Security in ASP.NET Web Applications
data where one must be converted to the type of the other. Additionally, the verification process
restricts a programmer’s ability to use pointer data types to point to arbitrary locations in memory.
This restriction prevents corruption of the state of the machine, because using pointer data types
and modifying arbitrary locations in memory could allow state data or memory management data
to become corrupted. By default, code that is not verifiably safe is not run on a machine, unless it
is local.
Application Domains
In modern execution environments, applications are isolated from each other and cannot directly
manipulate another processes’ memory or resources. This is a good design principle because
applications cannot have an accidental adverse effect on other running applications, and
applications cannot maliciously use other applications to leverage access.
The .NET framework extends this principle by introducing application domains. Application
Domains enforce resource or privilege isolation within a process and can be used for high-end
server applications to run multiple domains in one process. This ability can minimize the cost of a
context-switch operation, while still providing the security of applications not affecting each other.
This feature requires that the verification engine guarantee the inability of applications to jump to
or modify arbitrary locations in memory.
Configuration
Now that this paper has discussed security mechanisms, this section lists some of the
parameters that can be used to help deploy a secure .NET server. This section describes useful
configuration tips for achieving a higher level of security than the default setup.
Managing Code Groups
Evidence and code group configuration can be set with one of two tools: the code access security
policy tool (caspol.exe) or the .NET framework configuration tool (mscorcfg.msc). In this section
the use of caspol.exe will be demonstrated, but similar operations can be performed with
mscorcfg.msc.
Viewing Security Policy
To view the current policies in action (the code group hierarchy):
caspol [-<level>] -list
The optional level argument defines what policy level you want to list code groups for. It may be
either:
1. enterprise
2. machine
3. user
4. all
This argument may be omitted, in which case the “all” option will be assumed.
To view a code group list, or details:
Caspol [-<level>] [-listgroups|-listdetails]
The levels are identical to the options described in the previous command.
An ISS X-Force™ White Paper Page 13
15. Security in ASP.NET Web Applications
Figure 6. Using caspol to view current policies.
Adding a Code Group
To add a group:
caspol [-<level>] -addgroup <parentname|parentlabel> <membership>
<permission set> [-name name] [-description description] [-exclusive
on|off]
The arguments are:
Parentname – The parent code group name that the new code group will be added to under the
code group hierarchy.
Parentlabel – The label of the parent code group.
Membership – Membership condition for this code group. The membership arguments are listed
in the “Membership flags” section later in this paper.
Permission Set – Name of the permission set to apply to the new code group. These are
discussed in section 4.3.
Name – Name of the new code group.
Description – Description of the new code group.
Exclusive – Indicates whether the new groups permissions will override that of other code
groups in the same policy level.
An ISS X-Force™ White Paper Page 14
16. Security in ASP.NET Web Applications
Removing Code Groups
To remove a code group:
caspol [-<level>] -remgroup <grouplabel|groupname>
Where:
1. grouplabel ― label of the group to remove
2. groupname ― name of the group to remove
The level is the same as those described in the “Viewing Security Policy” section earlier in this
paper, except that you cannot use the “all” qualifier.
Changing Code Groups
Code Groups can be modified and can be assigned new permission sets, membership
requirements, name, or description. To change a group:
caspol [-<level>] -chggroup <grouplabel|groupname> <attribute changes>
Where:
grouplabel – label of the group to change
groupname – name of the group to change
The attribute changes supplied can be any of the parameters for adding a code group, as listed in
the “Adding a Code Group” section earlier in this paper.
Membership flags
The following list of membership flags and their descriptions are used when adding or modifying
code groups. These flags compare evidence and classify assemblies into code groups.
all – All code.
appdir <directory> – Specifies an application directory in which an assembly resides.
hash <hashalg> <-hex value|-file assembly> – Specifies a hex value or assembly file with a
hash.
pub <-cert cert_name|-file signed_file|-hex hex_string> – Specifies assemblies with a
certificate, a signature, or a hexadecimal representation of an X.509 certificate.
site <site> – Specifies a site from which assemblies originate.
URL <url> – Specifies a URL from which assemblies originate.
zone <zone name> – Specifies the name of the zone from which assemblies originate. The zone
name can be MyComputer, Intranet, Trusted, Untrusted, and Internet.
It is also possible to specify custom membership conditions using XML files.
Configuring Permission Sets
Permission sets are applied to code groups that were discussed in the previous section. This
section examines how to set up these permission sets. Permission sets are also administered
with the capsol tool.
An ISS X-Force™ White Paper Page 15
17. Security in ASP.NET Web Applications
Viewing Permission Sets
To view permission sets:
capsol [-<level>] -listpset
The level is the same as described in the “Viewing Security Policy” section earlier in this paper.
Figure 7. Using caspol to view permission sets.
Adding a Permission Set
To add a permission set:
capsol [-<level>] -addpset psetfile [psetname]
Where:
psetfile – Specifies an XML file that contains the permission set to add. XML Files for permission
sets are configured using the <PermissionSet> and <Ipermission> tags.
psetname – Specifies a name for the permission set.
Deleting a Permission Set
To delete a permission set:
capsol [-<level>] -rempset psetname
Where:
An ISS X-Force™ White Paper Page 16
18. Security in ASP.NET Web Applications
psetname – Specifies a name for the permission set.
Changing a Permission Set
To change a permission set:
capsol [-<level>] -chgpset psetfile psetname
Where:
psetfile – Specifies an XML file that contains the permission set to add. XML Files for permission
sets are configured using the <PermissionSet> and <Ipermission> tags.
psetname – Specifies a name for the permission set.
Secure Programming Tips
Some of the security features described in previous sections require secure programming
practices rather than configuration. This section gives a brief overview of some of the
programming features present in .NET that can provide the application programmer with a way to
ensure secure transmission and execution of assemblies and their associated data.
Cryptography Classes
For secure transmission of sensitive data, .NET provides the System.Security.Cryptographic
namespace. A large number of classes exist in this namespace, which allow for algorithm service
provision as well as classes for encrypting and decrypting data using these service providers.
Cryptographic implementation within the .NET framework is streams based. This is done utilizing
the CryptoStream class. The CryptoStream class is similar to an IO Stream, with methods
allowing for reading, writing, and seeking.
Configuration files
Configuration parameters presented in this document are contained in either the machine.config
file or web.config files in the application directories. A malicious user attempting to subvert
security mechanisms controlled by the runtime will find these files and their information highly
useful.
The machine.config file is by default readable by everyone. This is not a problem unless the
processModel tag is used to specify an alternate user to execute applications. The plaintext name
and password is contained in this file and would help local attackers gain access to a different
account. Additionally, if an attacker gains write access to this file, he or she could enable
applications to run with SYSTEM privileges without knowing the password.
Web.config files are also important to protect. These files hold information about who has
permissions to use applications and can possibly be read to obtain names and passwords
specific to the application. By default, IIS will not allow web.config files to be served to clients, so
this information normally cannot be accessed. However, developers should be careful when
writing applications so clients do not have the ability to read arbitrary files, since these
permissions could be abused to read Web configurations. Also, improper permissions may allow
malicious users to write their own web.config files, which would allow them to specify custom
authentication mechanisms and potentially execute malicious code.
Code Access Security
Code Access Security is part of the .NET Framework security model. Code originating from
different zones has different privileges granted to it that affect what it may or may not be allowed
to do. By default, local code is allowed to do a large number of things, which includes gaining
higher privileges and accessing local resources.
An ISS X-Force™ White Paper Page 17
19. Security in ASP.NET Web Applications
A compromised Web application may use this feature to its advantage, taking control of the
computer and subverting many security checks that are inherent in the .NET framework. An
administrator can apply configurations that greatly reduce an application’s ability to be subverted.
An administrator can specify directories (in this instance, publicly served Web directories) in
which assemblies have reduced trust on the computer.
CAS can be done imperatively or declaratively; both achieve the same effect. Programmers can
demand that callers have correct permissions using the Demand() method of the various
permissions classes (FileIOPermission, ZoneIdentityPermission, and so on), bypass stack walk
checks with the Assert() method, or Deny access to resources when they’re not in use using the
Deny() method.
Cookies
The “Forms” authentication mechanism stores authentication credentials in cookies, which are
relayed to and from the server. Attackers who are watching a transaction can obtain these
authentication credentials. Administrators are strongly recommended to use SSL whenever using
the forms authentication mechanism.
Conclusion
ASP.NET applications can be configured to ensure that clients are securely authenticated and
provided access in a controlled manner. This paper has presented configurations that allow for
the secure deployment of applications in a distributed environment.
An ISS X-Force™ White Paper Page 18