Securing ASP.Net Web Services

Please note that topics, agenda and labs are subject to change, and may adjust during live delivery based on audience interests and skill-level.

Session: Bug Hunting Foundation

Lesson: Why Hunt Bugs?

· Security and Insecurity

· Dangerous Assumptions

· Attack Vectors

· Lab: Case Studies in Failure

Lesson: Safe and Appropriate Bug Hunting/Hacking

· Working Ethically

· Respecting Privacy

· Bug/Defect Notification

· Bug Bounty Programs

Session: Securing Applications Foundation

Lesson: Removing Bugs

· Open Web Application Security Project (OWASP)

· OWASP Top Ten Overview

· Web Application Security Consortium

· CERT Secure Coding Standards

· Bug Hunting Mistakes to Avoid

· Tools and Resource

Lesson: Principles of Information Security

· Security Is a Lifecycle Issue

· Minimize Attack Surface Area

· Layers of Defense: Tenacious D

· Compartmentalize

· Consider All Application States

· Do NOT Trust the Untrusted

· Tutorial: Working with Visual Studio

· Lab: Case Study Setup and Review

Session: Applying Security to Services

Lesson: Service Challenges

· Services Overview

· Identity and Propagation

· Real-time Transactions

· Diverse Environments

· Information Protection

· Standards compliance

Lesson: Services and Security

· Security Policies

· Applicable OASIS Standards

· SAML

· SAML Usage Scenarios

· Oauth 2.0 and OpenID

· Lab: Working with OAuth

Session: Defending Services

Lesson: Defending Web Services

· Web Service Security Exposures

· When Transport-Level Alone is NOT Enough

· Message-Level Security

· WS-Security Roadmap

· XWSS Provides Many Functions

· Web Service Attacks

· Web Service Appliance/Gateways

· Lab: Web Service Attacks

Lesson: Defending Rich Interfaces and REST

· How Attackers See Rich Interfaces

· Attack Surface Changes When Moving to Rich Interfaces

· Bridging and its Potential Problems

· Three Basic Tenets for Safe Rich Interfaces

· OWASP REST Security Recommendations

Session: Bug Stomping 101

Lesson: Unvalidated Data

· Buffer Overflows

· Integer Arithmetic Vulnerabilities

· Unvalidated Data: Crossing Trust Boundaries

· Defending Trust Boundaries

· Whitelisting vs Blacklisting

· Lab: Defending Trust Boundaries

Lesson: A1: Injection

· Injection Flaws

· SQL Injection Attacks Evolve

· Drill Down on Stored Procedures

· Other Forms of Injection

· Minimizing Injection Flaws

· Lab: Defending Against SQL Injection

Lesson: A2: Broken Authentication

· Quality and Protection of Authentication Data

· Handling Passwords on Server Side

· SessionID Risk Reduction

· HttpOnly and Security Headers

· Lab: Defending Authentication

Lesson: A3: Sensitive Data Exposure

· Protecting Data Can Mitigate Impact

· In-Memory Data Handling

· Secure Pipes

· Failures in TLS/SSL Framework

· Lab: Defending Sensitive Data

Lesson: A4: XML External Entities (XXE)

· XML Parser Coercion

· XML Attacks: Structure

· XML Attacks: Injection

· Safe XML Processing

· Lab: Safe XML Processing

· Lab: Dynamic Loading Using XSLT (Optional)

Lesson: A5: Broken Access Control

· Access Control Issues

· Excessive Privileges

· Insufficient Flow Control

· Unprotected URL/Resource Access

· Examples of Shabby Access Control

· Sessions and Session Management

· Exercise: Unsafe Direct Object References

· Exercise: Spotlight on Verizon Exploit

Session: Bug Stomping 102

Lesson: A6: Security Misconfiguration

· System Hardening: IA Mitigation

· Application Whitelisting

· Least Privileges

· Anti-Exploitation

· Secure Baseline

Lesson: A7: Cross Site Scripting (XSS)

· XSS Patterns

· Persistent XSS

· Reflective XSS

· DOM-based XSS

· Best Practices for Untrusted Data

· Lab: Defending Against XSS

Lesson: A8/9: Deserialization/Vulnerable Components

· Deserialization Issues

· Identifying Serialization and Deserializations

· Vulnerable Components

· Software Inventory

· Managing Updates

· Lab: Spotlight on Equifax Exploit

Lesson: A10: Insufficient Logging and Monitoring

· Fingerprinting a Web Site

· Error-Handling Issues

· Logging In Support of Forensics

· Solving DLP Challenges

· Lab: Error Handling

Lesson: Spoofing, CSRF, and Redirects

· Name Resolution Vulnerabilities

· Fake Certs and Mobile Apps

· Targeted Spoofing Attacks

· Cross Site Request Forgeries (CSRF)

· CSRF Defenses

· Lab: Cross-Site Request Forgeries

Session: Moving Forward

Lesson: What Next?

· Common Vulnerabilities and Exposures

· CWE/SANS Top 25 Most

Dangerous SW Errors

· Strength Training: Project Teams/Developers

· Strength Training: IT Organizations

· Lab: Spotlight on Capitol One Exploit

Lesson: .NET Issues and Best Practices

· Manage Code and Buffer Overflows

· .Net Permissions

· ActiveX Controls

· Proper Exception Handling

· Lab: Securing the Business Layer

· Web Service Attacks

Time Permitting:

Lesson: Cryptography Overview

· Strong Encryption

· Message Digests

· Encryption/Decryption

· Keys and Key Management

· NIST Recommendations

Lesson: .NET Cryptographic Services

· The role of cryptographic services

· Hash algorithms and hash codes

· Encrypting data symmetrically

· Encrypting data asymmetrically

· Lab: .Net Hashing (Optional)

· Lab: .Net Symmetric Encryption

· Lab: .Net Asymmetric Encryption (Optional)