1) The authors describe how they secured a web application and backend systems to win an OpenHack competition by focusing on principles like reducing the attack surface, using strong authentication and encryption, validating all inputs, and implementing defense in depth. 2) Key aspects of their approach included using forms authentication for the web app, encrypting secrets, validating all user inputs with multiple checks, configuring IIS, Windows, SQL Server, and IPSec policies following security best practices. 3) They were able to securely manage the systems remotely using a VPN, Terminal Services, and restricted file shares while preventing firewalls.

1. Surviving OpenHack 4 Steve Riley and Timothy Bollefer Microsoft Corporation

4. Web application

11. Web.config files demo

19. Input validation code demo

25. Code for storing secrets demo

26. Internet Information Services 5.0

35. IISLockDown Extension remapping Accounts URLScan Folder/log ACLs demo

36. Windows 2000 Advanced Server

44. Registry tweaks demo

45. IPSec policies

49. IPSec policies Relationships

50. IPSec UI— each server’s policy demo

51. Remote management and monitoring

56. Remote management Physical network

57. VPN configuration demo

58. SQL Server 2000

65. SQL Server configuration demo

66. Passwords

68. Learnings

71. © 2003 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY.