E.Security Architecture

Authentication
1. 1. Anonymous : Use only when there is not secure content on website such as public facing internet sites.
  2. Windows:Must use if you have windows AD infrastructure
  3. Forms: If do not have windows AD infrastructure or need to use SSO

1. Federated , SSO and Enterprise SSO
2. ASP.Net Authentication Providers
  1. Forms Authentication Provider
  2. Windows Authentication Provider

1. URL Authorization : Support user level , role based and verb based authorization.
2. ACL Based Authorization : Uses file system based ACLs
  1. ASP.NET Impersonation : Can be used to propagate credentials of requesting user.
3. Sitemap Trimming : Prevent unauthorized use to see your site pages.

1. MAC Protection
2. View State Encryption
3. Control State Encryption
4. Per-user View State Encoding

1. SQL & Script Injection :
  1. 1. This is most common exploit is asp.net security vulnerability.

1. DOS Attack by posting large form data
2. Request Validation
3. Cross Site Scripting

- 1. Cross-site request forgery (CSRF) Attack: Letest version of ASP.Net project by default support CSRF protection

- 1. Do not trust any user input always validate user input and encode any text before being displayed on the page.

1. WindowsTokenRoleProvider : If we are using windows authentication then we should try to use built in configuration (web.config) based authorization instead of explicitly using WindowsTokenRoleProvider Class
2. Mark your Cookie HTTP Only : Always Mark your cookie HTTP only so that it can be accessed via HTTP only not by some script.
  1. Always turn off tracing in production environment.
  2. Always turn on custom error in production environment
3. The <deployment retail=”true”/> Switch in Maching.config

- 1. Always use ASP.Net Request Validation
  2. Keep Max Request Limit reasonable to Prevent DOS attack
  3. Prefer turning off UseUnsafeHeaderParsing that prevent script injection attack

1. Prefer Setting the SlidingExpiration property to false that can improve the security of an application by limiting the time for which an authentication cookie is valid, based on the configured timeout value.

- 1. Do not prefer Cookie less authentication (i.e. url based auth code) it can lead to replay attack.
  2. Protect your Cookie by turning protection mode =Encryption and Validation.
  3. If required Explicitly use attribute encoding because not all the properties in ASP.Net controls are encoded
  4. Use Anti-Cross Site Scripting Library

1. Prefer using X- Frame Option (XFO) set to SAMEORIGIN this prevent click jacking

- 1. Prefer using Trusted Connection (Windows Authentication) in place of User Name/Pw in connection strings
  2. Always verify Securing Elmah logging libs in ASP.NET website failing to this can expose several sensitive information
  3. Do not ever set EnableViewStateMac to false, because it may break application in future as MS is planning to deprecate it.

- 1. http://nwebsec.codeplex.com/ a tool that helps securing your asp.net website by manipulating various security options.
  2. https://asafaweb.com a site that dynamically test your websites form most common type of security venerability