Interakting Blogs

Security: Conducting a Security Review and why your designs should incorporate Defence-In-Depth?

Stephen Horsfield — Fri, 04 Jul 2008 02:55:45 GMT

I'm currently conducting a due-diligence review of a technical system. The system is a classic distributed, two-tier system with data held centrally and business-logic delegated to an application tier. I've been asked to perform a security analysis as part of my review. I can't tell you anything about the project itself, for confidentiality (and security) reasons, but I thought I'd share some of the thought processes behind what I've been doing.

Reviewing security

The foremost rule of security assessment is to include the entire system. Don't just look at technical aspects of security but also at non-technical risks. Here's an example: a password is a common technical security measure, but if steps aren't taken to prevent users from posting their passwords on the Internet, then the password is useless, even if it regularly expires and uses strong password controls.

There is a similar problem when security is not appropriately applied. When there is a too restrictive or misunderstood technical security requirement, individuals will look for and often find a way round the problem, often by disobeying the very policies that are critical non-technical security measures.

The solution? Security measures must be appropriate, proportionate, understood and trusted. If you don't get the buy-in of your users then these measures have no or else limited value.

Understanding the threats

The second rule of security assessment is to address the organisation's blind-spots. Legitimate users of systems are also potential attackers, sometimes intentionally, sometimes maliciously and sometimes they are simply applying their own pragmatism, "surely the business doesn't want me to spend all that time jumping through these policy hoops? I can save the company money if I do it like this...".

Create buy-in

Next, make sure that you employ security measures that your legitimate users are willing to employ. There is no value in creating 60 character random passwords. Your users will never remember them and so they'll write them down. Probably, they'll leave them next to the computer as well...

Implement Defence-In-Depth

Defence-In-Depth is the principle of checking security at each component of a system. It ensures that a breach in an outer component doesn't automatically gain unrestricted access to the assets at a deeper level. In my analysis I found that this principle had not been applied and that meant that a breach at the outermost level could result in unrestricted access to substantially more data than a user was normally entitled to.

Another resulting effect of the Defence-In-Depth approach is that it allows for clear security boundaries to be applied. Within the data centre the organisation has effective security capabilities but once the data has left this secure area the degree of control is reduced.

So how does Defence-In-Depth compare in a two-tier system?

Without Defence-In-Depth

In this scenario, all security checks are performed only once at the application layer, the communication layer or the data layer. Let's look at the implication of each option in turn:

1. Controls at the application layer only

In this case, if a user can breach the communication mechanism or the application code, then the user gains total access to all data in the system. This presents some major difficulties from a security perspective as it can be relatively easy to break one or both of these using reverse-engineering or eavesdropping approaches.

2. Controls at the communication layer only

Securing the communication layer alone allows users to have complete access to the data and to do anything with it. This provides no protection whatsoever from the insider, and that includes anyone who manages to break into the environment.

3. Controls at the data layer only

In this case, the access to data can be secured, however the data may be misused or transferred outside of the application. The security at the data layer must be substantially hardened to prevent malicious users from causing unintended behaviour. Once the data has left the data centre, the organisation no longer has any control over it.

With Defence-In-Depth

The Defence-In-Depth approach is pessimistic. It chooses to secure all three layers used in this system:

1. Controls at the application layer first

This limits those allowed to use the application. If it is breached, the user still has to break both the communication layer and the data layer security mechanisms.

2. Controls at the communication layer

This provides two added benefits. Firstly, it limits the potential to break the application because the application's communications are encrypted. Correct protocols can also prevent replay attacks and man-in-the-middle attacks.

Secondly, it enables the data layer to only allow access through this secure medium, limiting its exposure to other systems.

3. Controls at the data layer

The data layer ensures that the application only has access to the data that the application's user is entitled to. This limits the exposure of data. Because the other two layers have hardened the access mechanism, the data layer is less susceptible to direct attacks using otherwise valid credentials.

Conclusion

Applying Defence-In-Depth won't solve all your problems, and it will introduce additional design complexity. However, it should be applied to distributed systems where security is an imperative.

Metadata

Categories: Business, Security, Software Development
Additional keywords: Defence In Depth, security policy, secure design
Technorati Tags: software development, business, strategy, best practice, security security review Defence-In-Depth

Choosing the best way to compare text to empty strings

Dominic — Thu, 03 Jul 2008 00:45:19 GMT

I don’t know about you, but when I’ve seen some string comparisons, some people use:

     string text = GetStringFromDB() 

    if( text != string.Empty ) 

        DoThis();

This looks good, but its actually quite a long running process, as the CLR has to compare both strings character by character. It is much better to use String.IsNullOrEmpty to cater for this, or use .Length == 0 property, as this never changes and is computed when assigned. Here is what the String.IsNullOrEmpty method looks like:

    public static bool IsNullOrEmpty(string value)

    {

        if (value != null)

        {

            return (value.Length == 0);

        }

        return true;

    }

If you use != , or ==, or .Equals() the method, it uses some hefty pointer manipulation like this:

    public bool Equals(string value)

    {

        if ((value == null) && (this != null))

        {

            return false;

        }

        return EqualsHelper(this, value);

    }

    private static unsafe bool EqualsHelper(string strA, string strB)

    {

        int length = strA.Length;

        if (length != strB.Length)

        {

            return false;

        }

        fixed (char* str = ((char*) strA))

        {

            char* chPtr = str;

            fixed (char* str2 = ((char*) strB))

            {

                char* chPtr2 = str2;

                char* chPtr3 = chPtr;

                char* chPtr4 = chPtr2;

                while (length >= 10)

                {

                    if ((((*(((int*) chPtr3)) != *(((int*) chPtr4))) || (*(((int*) (chPtr3 + 2))) != *(((int*) (chPtr4 + 2))))) || ((*(((int*) (chPtr3 + 4))) != *(((int*) (chPtr4 + 4)))) || (*(((int*) (chPtr3 + 6))) != *(((int*) (chPtr4 + 6)))))) || (*(((int*) (chPtr3 + 8))) != *(((int*) (chPtr4 + 8)))))

                    {

                        break;

                    }

                    chPtr3 += 10;

                    chPtr4 += 10;

                    length -= 10;

                }

                while (length > 0)

                {

                    if (*(((int*) chPtr3)) != *(((int*) chPtr4)))

                    {

                        break;

                    }

                    chPtr3 += 2;

                    chPtr4 += 2;

                    length -= 2;

                }

                return (length <= 0);

            }

        }

    }

So in essence, don’t use != because

It is massively slower
It doesn’t take culture into consideration.
It caters for 2 cases instead of 1 – what would you do if the string was null?

Problems serializing a generic list using SoapFormatter

Raymond Little — Wed, 02 Jul 2008 01:22:43 GMT

Just recently I have been studying for my MCTS foundation exam and as part of this I had created a windows for application for calculating golf scores. As part of this application I was storing the information in a generic list of a custom Person class. I decided to extend the functionality by allowing the user to export and import the information and thought it would be an ideally opportunity to practice serialization.

At first I was using a binary formatter and everything worked fine, however I decided to try using the SoapFormatter instead. I changed the code to use SoapFormatter and expected everything would just work as I had test it using the binary formatter but when I ran the program I got an error saying

"Soap Serializer does not support serializing Generic Types : System.Collections.Generic.List`1[GolfScores.Person]."

After spending some time researching the problem I found an interesting discussion on the MSDN forum about this error, http://forums.msdn.microsoft.com/en-US/netfxremoting/thread/ee4a7a63-290e-432f-bd45-44f4cb7a3467/.

Apparently there are ways around this but for the purposes of my golf application I was able to use the XmlSerializer. Most people use generics these days so its something to consider when you are looking to use the to serialize information stored in a generic list.

Making decisions easier for null values with the ?? (null coalescing) operator

Dominic — Tue, 01 Jul 2008 06:50:42 GMT

When catering for null values, I use the ternary operator ?, which is used to do an inline IF statement. For example:

public void CheckText(string text)
{
    if(String.IsNullOrEmpty(text))
    {
        throw new ArgumentException("Parameter is " + (text==null ? "null." : "empty."));
    }
    
    //Other code here
}

This would allow you to cater for 2 exception cases:

When the parameter is null, the exception message states "Parameter is null.";
When the parameter is "", the exception message states "Parameter is empty.";

Since testing for null is a fairly common operation, and also catering for the possibility of a null, there is an operator called the null coalescing operator. The operator is used to check a value for null, and return an alternative value if the result is null

Before:

string text = ReadFromDB();
 
if(text == null)
    Console.WriteLine("(null)");
else
    Console.WriteLine(text);

After:

string text = ReadFromDB();
 
Console.WriteLine( text ?? "(null)" );

So, the way it works is it checks the first variable. If it is not null it returns the first variable, otherwise it returns the second. It is a shorthand method of this made up method:

public static object GetObject(object o, object _default)
{
     if( o == null )
          return _default;
     else
        return o;
 
    //Or return (o==null?_default:o);
}

The main use of this would be for outputting data to a table, or to a stream - but it looks like something I will definitely use in the future, instead of my long winded ternary operators ?

Restoring a site tree in ADAM

Raymond Little — Mon, 23 Jun 2008 04:34:57 GMT

Recently one of our clients wanted to update their staging environment with the content from live so they could test with up to real content. Having done this before I thought this would be an easy job, however I found a slight issue with the restore process.

When performing the back up one of the parameters allows you to specify if you are exporting from AD/AM. What the documentation doesn't tell you is you also have to specify this when you are trying to restore the back up. If you don't include this you get an extremely unhelpful 'Index out of range. Must be non-negative and less than the size of the collection' error.

I spent a good while checking the command, checking the XML that was generated, changing the parameters to try and identify what section was causing the problem until I double checked the command line help and spotted the /ADAM parameter. Initially I didn't think this would be the issue as I assumed that there would be a more helpful error message if you missed out the switch but no as soon as I added this everything worked fine.

Hopefully this will save you some time if you encounter this problem.

Create your own configuration settings with ConfigurationSetting

Dominic — Mon, 23 Jun 2008 02:17:40 GMT

I remember a while ago writing an application and wanting to feed in some configuration settings. I was just using AppSettings, but the problem was that all settings were strings, so I had to cast several variables, and write loads of error checking just to get the application up and running.

The application in question had several settings including a mixture of booleans, integers and strings. I had to parse them and then error check these values, to make the application more stable. It did create a heap of try/catch blocks that, as you will see are now unnecessary. Here is how the application used to work:

public void Initialize()
{
    int timeout = 0;
 
    if (int.TryParse(ConfigurationManager.AppSettings["Timeout"], out timeout))
    {
        if (timeout < 0)
            throw new ConfigurationErrorsException("Timeout must be >= 0");
        else
            this.Timeout = timeout;
    }
    else
    {
        throw new ConfigurationErrorsException("Timeout is not a valid integer");
    }
 
    ...
}

Now, although this is quite extensive error checking, the reasoning behind it is purely because we are dealing with strings. Can't the .NET framework do this for us!? YES!

In .NET 2.0, they have made it so easy to have your own Configuration Sections, and even making them type safe too! All with the help of the System.Configuration.ConfigurationSection (in System.Configuration.dll, not in System.dll).

All we have to do is create a class that inherits from System.Configuration.ConfigurationSection and then apply a couple of attributes! Then, we can give this class meaningful property names.

There are 4 steps to this:

Create an entry in your Configuration file to hold the data
Create a class to read the settings into
Create an entry in your Configuration file to tell the CLR what class will it read the information info.
Read the section from the ConfigurationManager (or WebConfigurationManager).

Create an entry in your Configuration file to hold the data

I would like to declare my XML like this:

<UseWebService available="true" timeToRespond="100" address="http://www.tempuri.org" />

Create a class to read the settings into

So lets say we want to store:

Enabled = Bool, must be defined
Timeout = Integer, Must be >= 0
Url = string, optional

We just create a class that inherits from System.Configuration.ConfigurationSection and declare these properties, and use get/set to set the values on the base class.

Therefore I will assign the "available" in the property "Enabled", "timeToRespond" to "Timeout" and "address" to "Url".

Firstly, I'll create my class. Notice that I'm not using the same text as the attribute in the XML - e.g. I use base["enabled"] instead of base["available"] ... This will be explained shortly.

public class UseWebServiceSection : ConfigurationSection
{
 
    public bool Enabled
    {
      get { return (bool)base["enabled"]; }
      set { base["enabled"] = value }
    }
 
    public int Timeout
    {
         get { return (int)base["timeout"]; }
         set { base["timeout"] = value }
    }
 
    public string Url
    {
         get { return (string)base["url"]; }
         set { base["url"] = value }
    }
}

This isn't enough. We're assigning the values, but the class can actually pull the values out and assign them for us with the use of the ConfigurationPropertyAttribute. This attribute allows us to assign which XML attribute will be bound to the property, but also set up default values too! So lets apply it to these values:

public class UseWebServiceSection : ConfigurationSection
{     
    [ConfigurationProperty("available", IsRequired= false, DefaultValue = true)]
    public bool Enabled    
    {      
        get { return (bool)base["enabled"]; }      
        set { base["enabled"] = value }    
    }
 
    [ConfigurationProperty("timeToRespond", IsRequired = true)]
    public int Timeout    
    {         
        get { return (int)base["timeout"]; }         
        set { base["timeout"] = value }    
    }     
    [ConfigurationProperty("address", IsRequired = true)]
    public string Url    
    {         
        get { return (string)base["url"]; }         
        set { base["url"] = value }    
    }
}

Lastly, there is a requirement that the Timeout field NEEDS to be >=0. So, we can use the IntegerValidatorAttribute to check this for us.

[IntegerValidator(MinValue=0)]
[ConfigurationProperty("timeToRespond",IsRequired=true)]
public int Timeout
{
    //As above
}

Create an entry in your Configuration file to tell the CLR what class will it read the information info

The most important part - the configuration file needs to know how to deal with this new section.

The configuration file has a section called "configSections". This element contains the definition for your new section, and what class to process it with. In our case it would look like:

<configuration>
    <configSections>
        <section name="UseWebService" type"UseWebServiceSection, MyNamespace.UseWebServiceSection"/>
    </configSection>
</configuration>

Read the section from the ConfigurationManager (or WebConfigurationManager).

Finally, the section now needs to be pulled out of the Configuration file.

UseWebServiceSection webService = (UseWebServiceSection)ConfigurationManager.GetSection("UseWebService");
Console.WriteLine("available = {0}",webService.Enabled);
Console.WriteLine("timeToRespond = {0}",webService.Timeout);
Console.WriteLine("address = {0}",webService.Url);

Summary

Having the ConfigurationSection class immensely simplifies creating type-safe configuration sections. It seems like a lot of work, but it isn't really. Just create a class, create your XML, add a section in the .config and then write a bit of code. Its easy when you know how!

In a later article, I will explain how you can write inner elements rather than just using attributes on one level.

NickServ and HydraIRC

Dan Matthews — Mon, 23 Jun 2008 01:11:59 GMT

I've been hanging out on the #epicode IRC channel for the past few months, and over time I've played with several IRC clients such as XChat, Mibbit (for the Web) and HydraIRC. One of the things that you do most often on IRC is /msg people. The server that I use for #epicode is FreeNode. This server requires you to register you nick before doing a /msg. If you try to /msg without registering, you get an error message back from the server. XChat, annoyingly, didn't show me the IRC error and I spent quite some time trying to figure out what was wrong. Mibbit behaves nicely, but you have to enter your credentials every time which is a pain. (tip: on Mibbit, click the 'Auth' link next to the server dropdown on the main page and you can enter your NickServ password straight in there!) HydraIRC behaves nicely too, but I've been having problems getting it to store my NickServ password so I don't have to enter it every time.

In theory, the password is saved by HydraIRC when you create a favourite, but it doesn't seem to work for channel favourites, only server favourites. No, I've no idea why. If you look in the XML profile file in the HydraIRC installation directory all the information looks correct. Maybe they work for you but they sure are a pain for me. Thankfully, there is an easy workaround. HydraIRC has a bit of a hack called Command Profiles. I wouldn't describe them as a well-documented feature but they do the trick. Essentially a command profile is just a set of IRC commands that can be run automatically when you connect to a particular IRC server. You can find the command profiles by going Options -> Prefs... -> Command Profiles. In there, you create a profile using a special name so that is picked up on logging in to a server. The name, in my case, is FreeNode_OnLoggedIn. Within that I simply put in my NickServ identification.

When I go to my #epicode channel favourite now, it automatically runs my identification with NickServ so that I can /msg people without the pesky error message and having to register myself manually with NickServ every time!