"Stay Safe" Cyber Security Blog : security

Secure Web Applications - The Microsoft Way

tarwine — Thu, 29 Nov 2007 19:15:00 GMT

A question came up this week on how to Secure Web Applications the Microsoft way.

Microsoft has extensive prescriptive guidance that applies to secure online applications.

Defense in Depth

1. Start by building on a Secure Platform:

· Windows Server 2003 with latest Service Pack - http://www.microsoft.com/windowsserver2003/default.mspx

· Windows SQL Server 2005 with Latest Service Pack http://www.microsoft.com/sql/default.mspx

· Implement Microsoft Best Practice Security Guidance for Servers - http://www.microsoft.com/technet/security/guidance/serversecurity.mspx

2. Build the application using best practice Secure Coding techniques

· Secure Coding Guidelines - http://msdn2.microsoft.com/en-us/library/d55zzx87.aspx

· Writing Secure Code - http://msdn2.microsoft.com/en-us/security/aa570401.aspx

3. Be aware of common threats to Applications and avoid SQL Injection & Cross Site Scripting attacks:

· “Stop SQL Injection Attacks Before They Stop You” - http://msdn.microsoft.com/msdnmag/issues/04/09/SQLInjection

· “How To: Protect From SQL Injection in ASP.NET” - http://msdn2.microsoft.com/en-us/library/ms998271.aspx

· “How to Prevent Cross Site Scripting” - http://support.microsoft.com/kb/252985

· “Anti-Cross Site Scripting Library” - http://msdn2.microsoft.com/en-us/security/aa973814.aspx

4. Use Network based Firewall at the perimeter –Forefront Edge: ISA 2006

· Secure remote access - http://www.microsoft.com/forefront/edgesecurity/sra.mspx

· Network protection against Floods & Attacks - http://www.microsoft.com/technet/isa/2006/flood_resiliency.mspx

5. Access the Application securely by Publishing through the Firewall & using appropriate security

· Publish Site using Forefront Edge Internet Application Gateway (IAG) with Application Layer Firewall - http://www.microsoft.com/forefront/edgesecurity/iag/default.mspx

· IAG Secure Remote Access White Papers - http://www.microsoft.com/forefront/edgesecurity/iag/whitepapers.mspx

· Use the practice of Least Privilege account access - http://www.microsoft.com/technet/security/secnews/articles/lpuseacc.mspx

6. Audit your Firewall, Application and Operating System Logs

· Audit Active Directory - http://support.microsoft.com/kb/814595

· Audit Policy - http://www.microsoft.com/technet/security/guidance/serversecurity/tcg/tcgch03n.mspx

· Audit ISA - http://www.microsoft.com/technet/isa/2006/security_guide.mspx

7. Use Secure Authentication Mechanisms (IAG can use AD, Kerberos, RADIUS, LDAP etc…)

· IIS Authentication - http://support.microsoft.com/kb/324274

· Kerberos Authentication in Windows Server 2003 http://www.microsoft.com/windowsserver2003/technologies/security/kerberos/default.mspx

8. Use Host based Antivirus & Antimalware protection on Clients and Servers

· Forefront Client Security - http://www.microsoft.com/forefront/clientsecurity/default.mspx

9. Keep all systems patched with latest Security Patches using Microsoft Update or WSUS

· Microsoft Windows Server Update Services (WSUS) - http://technet.microsoft.com/en-us/wsus/default.aspx

· How to keep your Windows up-to-date - http://support.microsoft.com/kb/311047

· Patch 3^rd party products that are not managed by Microsoft

o Backup Software

o Zip or Compression Utilities

o Antivirus

o IE Plug-ins

o Management Software

o etc….

Note: A System that is Fully Patched with Microsoft Updates can be vulnerable by un-patched vulnerable software with a driver or running with administrator privileges.

10. Remember the CIA Triad of security of Confidentiality, Integrity, and Availability

There are a number of other considerations to consider as well focusing on these 3

· Backups of Server 2003 & SQL 2005 Database

a. http://www.microsoft.com/technet/prodtechnol/sql/2005/bkupssas.mspx

b. http://technet.microsoft.com/en-us/library/aa998799.aspx

c. http://technet.microsoft.com/en-us/library/ms175477.aspx

· Load Balancing & Clustering

a. http://technet2.microsoft.com/WindowsServer/en/Library/1611cae3-5865-4897-a186-7e6ebd8855cb1033.mspx?mfr=true

b. http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/2d5977cf-06b7-4d4b-8e8c-ce083ac8a6ee.mspx?mfr=true

· High Availability & Disaster Recovery

a. http://www.microsoft.com/technet/security/guidance/disasterrecovery.mspx

b. http://www.microsoft.com/technet/windowsserver/sharepoint/V2/reskit/c2861881x.mspx

c. http://technet.microsoft.com/en-us/sqlserver/bb331801.aspx

· File Encryption (EFS & BitLocker)

a. http://www.microsoft.com/technet/security/guidance/cryptographyetc/efs.mspx

b. http://technet.microsoft.com/en-us/windowsvista/aa905065.aspx

Note: BitLocker will be available in Windows Server 2008 http://technet2.microsoft.com/WindowsVista/en/library/58358421-a7f5-4c97-ab41-2bcc61a58a701033.mspx?mfr=true

· Rights Management Services (RMS)

a. http://www.microsoft.com/windowsserver2003/technologies/rightsmgmt/default.mspx

b. http://www.microsoft.com/windowsserver2003/techinfo/overview/rm.mspx

Case Study

The Infrastructure of www.microsoft.com, Microsoft Update, and the Download Center

http://download.microsoft.com/download/6/2/b/62bae197-0d3d-4dbb-913a-acd21c57a2c7/DRJ_MSCom_Design_for_Resilience_FINAL.ppt

Conclusion

These are a few things to consider, but the key is to thinking about Defense in Depth and end-to-end security of the Data, Systems, Network Infrastructure, and Application.

You need to know first how to secure the application, but then you need to know how to identify threats when security is being tested and/or compromised and how to respond to those threats.

Online Internet Safety Resources

tarwine — Mon, 30 Jul 2007 08:00:00 GMT

Here are some resources from the Microsoft' Internet Safety Toolkit below to help keep you kids and family safe online:

• StaySafe.org (http://www.staysafe.org) - Educational site intended to help consumers understand both the positive aspects of the Internet as well as how to manage a variety of safety and security issues that exist online

• Be Web Aware (http://www.bewebaware.org) - National, bilingual public education program on Internet safety designed to ensure that young Canadians benefit from the Internet, while being safe and responsible in their online activities

• Safe Kids Worldwide (http://www.safekids.org) - Global network of organizations whose mission is to prevent accidental childhood injury, a leading killer of children 14 and under

• WebSafe Crackerz (http://www.websafecrackerz.com) - Interactive games and puzzles designed to help teenagers and offer strategies for dealing with different situations online including spam, phishing, and scams

• GetNetWise (http://www.getnetwise.org) - Public service offered by a coalition of Internet industry corporations and public interest organizations that want Internet users to be only "one click away" from the resources they need to make informed decisions about their and their family's use of the Internet

• iSafe (http://www.isafe.org) - Worldwide leader in Internet safety education; incorporates classroom curriculum with dynamic community outreach to empower students, teachers, parents, law enforcement, and concerned adults to make the Internet a safer place

• International Centre for Missing & Exploited Children (http://www.icmec.org) – Global agency that promotes the safety and well-being of children through activism, policy development and multinational coordination

• Interpol (http://www.interpol.int) - International police organization that facilitates crossborder police cooperation, and supports and assists all organizations, authorities, and services whose mission is to prevent or combat international crime

• UNICEF (http://www.unicef.org) – Global advocate for the protection of children's rights dedicated to providing long-term humanitarian and developmental assistance to children and parents in developing countries

• ECPAT (http://www.ecpat.net) - Network of organizations and individuals working together to eliminate the commercial sexual exploitation of children

• INHOPE (http://inhope.org) - International association that supports Internet hotlines in their aim to respond to reports of illegal content to make the Internet safer

• Childnet International (http://www.childnet-int.org) - Non-profit organization that works in partnership with others around the world to help make the Internet a great and safe place for children

• SafeKids.com (http://www.safekids.com) – Resources to help families make the Internet and technology fun, safe, and productive

• Net Family News (http://netfamilynews.org) – Non-profit public service providing a forum and "kid-tech news" for parents and educators in more than 50 countries

• Microsoft Security At Home (http://www.microsoft.com/protect) – Information and resources to help the public protect their computers, protect themselves, and protect their families

• Center for Safe and Responsible Internet Use (http://csriu.org) – Organization providing provide outreach services addressing the issues of the safe and responsible use of the Internet Microsoft Internet Safety Toolkit | 21

• WiredSafety (http://www.wiredsafety.org) – Online safety, education, and help group that offers help for online victims of cyber-crime and harassment, assistance to law enforcement worldwide on preventing and investigating cyber-crimes, and information on all aspects of online safety, privacy and security.

• National Council for Motherhood and Childhood (http://www.nccm.org.eg) – Egyptian organization dedicated to supporting childhood and motherhood from a rights-based approach

• NetAlert Limited (http://netalert.net.au) – Non-profit community organization established by the Australian government

In addition to these education resources above, I have also provided a list of Family Protection Software reviewed on:

http://www.filterguide.com/ratings.htm

Best Parental Control Software Review - "Editor's Choice"

http://www.filterguide.com/ratings.htm

Safe Eyes InternetSafety.com	Parental Control – SafeEyes Platinum content filter and parental control filter monitoring software will allow you to block porn, popups and more. *"Editor's Choice"*
NetNanny NetNanny.com	Content Filtering – Net Nanny internet filtering software was produced to filter, stop, and monitor internet porn sites. *"Editor's Choice"*
ContentPrtoect ContentWatch.com	Content Filtering – ContentPrtotect is now combined with the Net Nanny web filter and is listed as one of our top filters. *"Editor's Choice"*
BSafeOnline BSafeHome.com	Parental Control Software – Use the BsafeHome parental controls for internet blocking of porn and sits that are objectionable. *"Editor's Choice"*
Cybersitter CyberSitter.com	Cybersitter content filter software stops profanity, sex, nudity and pornography internet web sites from your computer.
Actmon ActMon.com	Internet Blocking Software – Act Mon Computer Control internet filtering software will keep an eye on and filter computer and PC workstations.
CyberPatrol CyberPatrol.com	Internet Filter Software Review – CyberPatrol 7 will watch who is permitted admittance to the internet, and filter everyplace those users surf on the internet.
Guardian Monitor GuardianSoftware.com	Internet Filters Software – Guardian Monitor monitors Peer to Peer, instant messaging, chat rooms, emails and websites.
ChildwebGuardian ChildWebGuardian.com	Internet Parental Software – Childwebguardian blocks profanity, sex, nudity, violence, adult websites, pornography, and more.
ComputerCop ComputerCop.com	Parental Controls Filters – ComputerCOP scans and views a computer, allowing parents a easy way to locate if the computer system has been incorrectly used.
SOS KidProof	Parental Control Internet Filter – SOS KidProof is the most far-reaching, well-featured software program offered for protecting and viewing your children’s website activity.

While I cannot guarantee the reliability of these 3^rd party sites and services, I do hope these resources are a helpful start in educating yourself and others about online cyber threats and responsible ways to deal with those threats.