Print this Page

.NET Code Security Access
Stopping the Barbarians at the Gate

All .NET components can expose their methods to the outside world through .NET Remoting or as a Web service.  .NET developers and security administrators must learn and practice effective Code Access Security (CAS) to prevent hackers from accessing private information or damaging your business applications by using design flaws or coding errors to breach security.

In today’s real .NET world, developers who don’t know better frequently build vulnerable components.  And companies often must acquire components they cannot fully test for trustworthiness.  Code quality varies among different vendors and testing will not reveal all the possible security problems.  Security measures rooted solely on the identity of the user running the application do not provide adequate protection.  Developers and administrators must work together to design and build effective security measures that control the executing code, whether the components are built internally or bought.

Code Access Security goes beyond conventional identity-based security practices to provide vital security protections that .NET applications cannot accomplish in any other way.

.NET Code Access Security teaches experienced .NET developers and security administrators to use the identity of the code to manage security.  This 4 day course, designed and taught by .NET consultant and instructor Michael Stiefel, teaches developers how to “practice safe .NET computing” through interactive discussion of key concepts, demonstrations of crucial programming tips and techniques, hands-on coding labs and best-practice explanations.

.NET Code Access Security introduces and explains common threat scenarios and how to avoid them.  Participants learn how to design corruption-resistant code components by:

• Using a “Threat Assessment” approach to evaluate code risks

• Authenticating based on what code is running

• Authorizing based on the rights associated with the code

• Utilizing the features of the Code Access Security to build secure .NET components

.NET Code Access Security will demonstrate how to administer CAS and show security administrators and application developers how to work together to identify what rights to grant to components and to define what rights each component needs to run.

This hands-on course requires a learner lab equipped with the suitable hardware and software, which will change as .NET continues to evolve.  We will work with clients to ensure the appropriate lab configuration.

Who Should Attend

• Experienced .NET Developers

• Designers and Builders of Web Services

• Designers and Builders of .NET components exposed via .NET Remoting

• Security Administrators

What You Will Learn

• Key Application Security Concepts

  • Security as an application requirement, just like functionality or performance

  • Threat Assessment: How to base security on Risk Management

  • Principle of Least Privilege

• Identity Management

  • Why defining security by user identity is not enough

  • Code Access Security (CAS): Defining security by code identity

• Preventing Unauthorized Access

  • Authentication: What code is running? Can you prove it?

  • Authorization: What is the code allowed to do?

• Assemblies

  • Unit of code deployment

  • Code Rights assignment to Assemblies and Application Domains

• Strong Names

  • How a Strong Name uniquely names an assembly.

  • Assembly name parts: Friendly Name, Version, Culture, and Publisher

  • How to use Public/Private Key technology to build Strong Name

• Security Evidence

  • How to assign Code Rights via Evidence

  • How to define your own Evidence

• Examples, Techniques and Best Practices

  • Security Evidence

  • CLR Hosts

  • Security Permissions

  • Permission Demands

  • Security Policy

  • Verifiable vs. Managed Code

  • Code Groups

  • Policy Levels & Policy Resolution

  • Modifying Security Policy

  • Declarative vs. Imperative Requests

  • Stack Walk

  • Partially Trusted Callers

  • Denying Permissions

  • Custom Permissions

Course Outline

1. .NET Concepts Underlying Code Access Security

• Verifiable vs. Managed Code

  • Managed Code and the Common Language Runtime

  • Type Safe Code and Verification

  • .NET Languages and Type Safe Code

  • Type Safe Code and Security

• Metadata

• .NET Assemblies as Components

  • Assembly Manifest

  • Strong Names

  • Assemblies and Security

• Application Domains and Security

2. Code Access Security Overview

• Code Access Security vs. Identity-Based Security

• Introduction to Security Policy

3. Security Evidence

• Host and Assembly Evidence

• Evidence and Security Policy

4. Security Permissions

• What are Permissions?

• Permission Sets

• Demanding Permissions

• Permissions and Stack Walks

5. Security Policy

• Creating Security Policy

• Trusted Code and Security Policy

• Code Groups and Named Permission Sets

• Policy Hierarchy and Policy Levels

• Policy Resolution

• Modifying Security Policy

6. Programming Code Access Security

• Demanding, Asserting and Denying Permissions

• Imperative vs. Declarative Security

• RequestMinimum, RequestOptional, and RequestRefuse

• Partially Trusted Callers

7. Code Access Security Administration

• The Security Administrator’s View of Code Access Security

• Deploying Security Policy

8. Common Code Access Security Scenarios

9. Advanced Topics

• Security and Loading Assemblies

• Writing Secure Assemblies

• Code Verification

• Common Language Runtime Hosts

• Custom Permissions

• Custom Evidence