Security MisconfigurationSecure ASP.NET Configuration, Password Management

Jiří Danihelka

Secure ASP.NET Configuration

3

OWASP Top 10 Security Risks for ASP.NET

10 most common security threats how to avoid them when creating websites how to perform hacking / penetration testing

4

Security Misconfiguration

Recommendations: This topic is very broad and it

is hard to give a general recommendation.

Check your website configuration carefully. Pay attention to settings related to security (e.g. session timeout).

Change default passwords Do not store production

credentials in the repository Use different credentials in

Dev and Live environments

5

Clickjacking

Attack description:- transparent iFrame that is controlled by user interaction- the use can unintentionally make requests he did not want to

6

Custom Errors

Recommendations: Use custom error pages RemoteOnly setting disables

custom errors on localhost

7

Information disclosure

Recommendations:<!-- enableVersionHeader - Remove the ASP.NET version number from the response headers. Added security through obscurity. --><httpRuntime targetFramework="4.5" enableVersionHeader="false" />

<httpProtocol> <customHeaders> <!-- X-Powered-By - Remove the HTTP header for added security and a slight performance increase. --> <clear /> </customHeaders></httpProtocol>

8

Leaving Tracing & Debuging Enabled

The trace feature of ASP.NET is one of the most useful tools that you can use to ensure application security by debugging and profiling your Web-based applications.

Unfortunately, it is also one of the most useful tools that a hacker can use to attack your Web-based applications if it is left enabled in a production environment.

9

Maximum URL Request Length

Recommendations:<!-- maxRequestLength="4096" - The maximum length of the url request in kilobytes. --><httpRuntime maxRequestLength="4096"/>

Password Management

How to properly store production passwords?

12

Store passwords in code repository? Definitely no!

Not all developers shouldhave access to productionpasswords

Problems with open-source projects

High risk of password leaking (e.g. during a code audit)

13

Store passwords in emails? No

Many emails Hard to update passwords Who has the password? Hard to restrict spreading

14

Store passwords in Confluence? No

Confluence is for documentation

Documentation is sharedwith other parties thatshould not have accessto passwords

Does not support different levels of access (dev, stage, pre-release, live)

15

Store passwords in Connection Strings? No Not all passwords are

connection strings Hard to protect and

retrieve later Sometimes have to

connect to the server

Solution: Password Management

17

Password Management

Live demo