CRV2 SecCommsdotNet - Revision history

Johanna Curiel at 14:30, 15 July 2013

2013-07-15T14:30:13Z

Johanna Curiel at 00:58, 15 July 2013

2013-07-15T00:58:09Z

Johanna Curiel at 00:56, 15 July 2013

2013-07-15T00:56:33Z

Johanna Curiel at 00:51, 15 July 2013

2013-07-15T00:51:02Z

Johanna Curiel at 00:39, 15 July 2013

2013-07-15T00:39:55Z

Johanna Curiel at 00:38, 15 July 2013

2013-07-15T00:38:36Z

Johanna Curiel at 00:35, 15 July 2013

2013-07-15T00:35:41Z

Johanna Curiel at 00:05, 15 July 2013

2013-07-15T00:05:24Z

Johanna Curiel at 23:54, 14 July 2013

2013-07-14T23:54:26Z

Johanna Curiel at 23:52, 14 July 2013

2013-07-14T23:52:42Z

← Older revision		Revision as of 14:30, 15 July 2013
Line 95:		Line 95:
	</system.webServer>		</system.webServer>
	</configuration>		</configuration>
		+
		+	===Filter High Bit Characters===
		+	This allows or rejects all requests to IIS that contain non-ASCII characters . When this occurs error code 404.12. is displayed to the user . The UrlScan(IIS6 add-on) equivalent is AllowHighBitCharacters.
		+
		+	<configuration>
		+	<system.webServer>
		+	<security>
		+	<requestFiltering
		+	allowHighBitCharacters="true">
		+	</requestFiltering>
		+	</security>
		+	</system.webServer>
		+	</configuration>
		+
		+	===Filter Based on File Extensions===
		+	Uisng this filter you can allow IIS to a request based on file extensions, the error code logged is 404.7. The AllowExtensions and DenyExtensions options are the UrlScan equivalents.
		+
		+	<configuration>
		+	<system.webServer>
		+	<security>
		+	<requestFiltering>
		+	<fileExtensions allowUnlisted="true" >
		+	<add fileExtension=".asp" allowed="false"/>
		+	</fileExtensions>
		+	</requestFiltering>
		+	</security>
		+	</system.webServer>
		+	</configuration>
		+
		+	===Filter Based on Request Limits===
		+	When IIS rejects a request based on request limits, the error code logged is:
		+	• 404.13 if the content is too long.
		+	• 404.14 if the URL is too large.
		+	• 404.15 if the query string is too long.
		+	This can be used to limit a long query string or too much content sent to an application which you cannot change the source code to fix the issue.
		+	<configuration>
		+	<system.webServer>
		+	<security>
		+	<requestFiltering>
		+	<requestLimits
		+	maxAllowedContentLength="30000000"
		+	maxUrl="260"
		+	maxQueryString="25"
		+	/>
		+	</requestFiltering>
		+	</security>
		+	</system.webServer>
		+	</configuration>
		+
		+	===Filter by Verbs===
		+	When IIS reject a request based on this feature, the error code logged is 404.6. This corresponds to the UseAllowVerbs, AllowVerbs, and DenyVerbs options in UrlScan.
		+	In case you want the application to use only certain type of verb, it is necessary to firt set the allowUnlisted to ‘false’ and then set the verbs that you would like to allow(see example)
		+
		+	<configuration>
		+	<system.webServer>
		+	<security>
		+	<requestFiltering>
		+	<verbs allowUnlisted="false">
		+	<add verb="GET" allowed="true" />
		+	</verbs>
		+	</requestFiltering>
		+	</security>
		+	</system.webServer>
		+	</configuration>
		+
		+	===Filter Based on URL Sequences===
		+	This feature defines a list of sequences that IIS reject when it is part of a request. When IIS reject a request for this feature, the error code logged is 404.5.This corresponds to the DenyUrlSequences feature in UrlScan.
		+	This is a very powerful feature. This avoids a given character sequence from ever being attended by IIS:
		+
		+	<configuration>
		+	<system.webServer>
		+	<security>
		+	<requestFiltering>
		+	<denyUrlSequences>
		+	<add sequence=".."/>
		+	</denyUrlSequences>
		+	</requestFiltering>
		+	</security>
		+	</system.webServer>
		+	</configuration>
		+
		+	===Filter Out Hidden Segments===
		+
		+	In case you want IIS to serve content in binary directory but not the bin, you can apply this configuration.
		+
		+	<configuration>
		+	<system.webServer>
		+	<security>
		+	<requestFiltering>
		+	<hiddenSegments>
		+	<add segment="BIN"/>
		+	</hiddenSegments>
		+	</requestFiltering>
		+	</security>
		+	</system.webServer>
		+	</configuration>

@@ Line 1: / Line 1: @@
 =ASP.NET Configurations=
-Sensitive data pass across networks. This data might include passwords, credit card numbers, social security numbers, you name it. To protect against disclosure of this information from unwanted eyes, it is essential to protect the data in transit from unwanted alteration.
+Sensitive data passes across networks. This data might include passwords, credit card numbers, social security numbers, you name it. To protect against disclosure of this information from unwelcome users, it is essential to protect the data in transit from unwanted alteration.
 Since web requests through physical tiers of an application crosses different communication channels, it must be considered how the application must be secure for each of these channels. Most of the security configurations in ASP.NET occurs on different files found in the application such as the web.config file or in the IIS server such as the policy files. The following information highlights the most important aspects to secure communications in ASP.NET applications

@@ Line 1: / Line 1: @@
 =ASP.NET Configurations=
-Since web requests through physical tiers of an application crosses different communication channels, it must be considered how the application must be secure for each of these channels. Most of the security configurations occurs on different files found in the application such as the web.config file or in the server such as the policy files. The following information highlights the most important aspects to secure communications in ASP.NET applications
+Since web requests through physical tiers of an application crosses different communication channels, it must be considered how the application must be secure for each of these channels. Most of the security configurations in ASP.NET occurs on different files found in the application such as the web.config file or in the IIS server such as the policy files. The following information highlights the most important aspects to secure communications in ASP.NET applications
 ==IIS 7 Configurations==

@@ Line 39: / Line 39: @@
   using System.Text;
   using Microsoft.Web.Administration;
   internal static class Sample
+  {
@@ Line 66: / Line 65: @@
 (Yakushev, 2008)
 ==Password protection and sensitive information==
@@ Line 148: / Line 177: @@
 ==References==
 Yakushev Ruslan , 2008 "IIS 7.0 Request Filtering and URL Rewriting " available at http://www.iis.net/learn/extensions/url-rewrite-module/iis-request-filtering-and-url-rewriting (Last accessed on 14 July, 2013)
 Aguilar Carlos ,2006 "The new Configuration System in IIS 7" available at http://blogs.msdn.com/b/carlosag/archive/2006/04/25/iis7configurationsystem.aspx (Last accessed on 14 July, 2013)
 MSDN, 2013 . How to: Lock ASP.NET Configuration Settings available at http://msdn.microsoft.com/en-us/library/ms178693.aspx (Last accessed on 14 July, 2013)

@@ Line 148: / Line 148: @@
 ==References==
 Yakushev Ruslan , 2008 "IIS 7.0 Request Filtering and URL Rewriting " available at http://www.iis.net/learn/extensions/url-rewrite-module/iis-request-filtering-and-url-rewriting (Last accessed on 14 July, 2013)
 Aguilar Carlos ,2006 "The new Configuration System in IIS 7" available at http://blogs.msdn.com/b/carlosag/archive/2006/04/25/iis7configurationsystem.aspx (Last accessed on 14 July, 2013)
 MSDN, 2013 . How to: Lock ASP.NET Configuration Settings available at http://msdn.microsoft.com/en-us/library/ms178693.aspx (Last accessed on 14 July, 2013)

← Older revision		Revision as of 00:35, 15 July 2013
Line 8:		Line 8:

	[[File:ConfigNETdiagram.png]]		[[File:ConfigNETdiagram.png]]
		+
		+	===Filtering Requests and URL Rewriting===
		+
		+	Request Filtering was introduced in IIS7 and it has replaced the functionality UrlScan add-on for IIS 6.0. This built-in security feature allows to filter undesired URL request but it is also possible to configure different kinds of filtering. To begin with, it is important to understand how the IIS pipeline works when a request is done. The following diagram shows the order in these modules
		+
		+	(Yakushev, 2008)
		+
		+	Request filtering can be setup through the IIS interface or on the web.config file. Example:
		+
		+	<configuration>
		+	<system.webServer>
		+	<security>
		+	<requestFiltering>
		+	<denyUrlSequences>
		+	<add sequence=".." />
		+	<add sequence=":" />
		+	</denyUrlSequences>
		+	<fileExtensions allowUnlisted="false" />
		+	<requestLimits maxUrl="2048" maxQueryString="1024" />
		+	<verbs allowUnlisted="false" />
		+	</requestFiltering>
		+	</security>
		+	</system.webServer>
		+	</configuration>
		+
		+	(Yakushev, 2008)
		+	This can also be done through the application code , for example:
		+
		+	using System;
		+	using System.Text;
		+	using Microsoft.Web.Administration;
		+
		+	internal static class Sample
		+	{
		+	private static void Main()
		+	{
		+	using (ServerManager serverManager = new ServerManager())
		+	{
		+	Configuration config = serverManager.GetWebConfiguration("Default Web Site");
		+	ConfigurationSection requestFilteringSection = config.GetSection("system.webServer/security
		+	/requestFiltering");
		+	ConfigurationElementCollection denyUrlSequencesCollection =
		+	requestFilteringSection.GetCollection("denyUrlSequences");
		+	ConfigurationElement addElement = denyUrlSequencesCollection.CreateElement("add");
		+	addElement["sequence"] = @"..";
		+	denyUrlSequencesCollection.Add(addElement);
		+	ConfigurationElement addElement1 = denyUrlSequencesCollection.CreateElement("add");
		+	addElement1["sequence"] = @":";
		+	denyUrlSequencesCollection.Add(addElement1);
		+	ConfigurationElement addElement2 = denyUrlSequencesCollection.CreateElement("add");
		+	addElement2["sequence"] = @"\";
		+	denyUrlSequencesCollection.Add(addElement2);
		+	serverManager.CommitChanges();
		+	}
		+	}
		+	}
		+
		+	(Yakushev, 2008)

	==Password protection and sensitive information==		==Password protection and sensitive information==

@@ Line 43: / Line 43: @@
   \Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys
-==User Key Container==
+===User Key Container===
 When the application that needs to be protected is in a shared hosting environment and protection of sensitive data cannot be accessible to other applications, the user key container is strongly recommended. In this case each application should have a separate identity.
 RSA user-level key containers are stored in the following folder:

← Older revision		Revision as of 23:52, 14 July 2013
Line 62:		Line 62:
	</system.web>		</system.web>

		+	====Lock Trust Levels====
		+	In the .NET framework web.config file is possible to lock applications from changing their trust level
		+	This file is found at:
		+	C:\Windows\Microsoft.NET\Framework\{version}\CONFIG
		+
		+	The following example shows how to lock 2 different application configuration trust levels (MSDN, 2013)
		+	<configuration>
		+	<location path="application1" allowOverride="false">
		+	<system.web>
		+	<trust level="High" />
		+	</system.web>
		+	</location>
		+	<location path="application2" allowOverride="false">
		+	<system.web>
		+	<trust level="Medium" />
		+	</system.web>
		+	</location>
		+	</configuration>


	==References==		==References==
		+	MSDN, 2013 . How to: Lock ASP.NET Configuration Settings available at http://msdn.microsoft.com/en-us/library/ms178693.aspx (Last accessed on 14 July, 2013)