Developing Securely In Windows

FrazzledDad writes "No, really. Please pick yourself up off the floor and stop laughing. Yes, there are good books on developing Windows software in a secure fashion. Keith Brown's The .NET Developer's Guide to Windows Security is right alongside Howard and LeBlanc's Writing Secure Code as examples of good Windows security works. Brown's book should be on any .NET Developer's bookshelf and will be of use to developers who work in other development platforms on Windows." Read on for the rest of the review.

The .NET Developer's Guide to Windows Security
author	Keith Brown
pages	408
publisher	Addison-Wesley
rating	9
reviewer	Jim Holmes
ISBN	0321228359
summary	Terrific coverage of how to go about securely developing .NET software

I know the entire topic of Windows security may kick off a "slightly" enthusiastic debate among Slashdotters. I'd really prefer not to get wrapped up in a fray, so let me just say that a professional software developer needs to well understand the security issues in the environment and platform they're working on. This book's an important aid in that understanding. Great Fundamentals

Brown's book is broken into six parts, ranging from "The Big Picture", an overview of security on Windows, to "Access Control" and a wrap-up "Miscellaneous." Each part is made up of numerous "items," one topic which Brown elaborates on.

Brown covers a lot of very basic, important fundamentals such as "What is Authentication?", "What is a Luring Attack?", and "What is Kerberos?" He gives concise, clear overviews of each topic, then gets into the weeds where necessary.

For example, one of Brown's first emphatic points is that development on Windows platform shouldn't be done using an account with Administrator privileges. He covers the "why" in several early items, then spends 11 pages in Item 9 showing the approaches, tools, and issues involved in developing under a non-Admin account. This particular item needs to be stapled to far too many developers' foreheads because they don't understand, or care about, the ramifications of development as an Admin. Great Details

Brown also goes into great detail on many Items. His discussion of IPSEC is a good example. He spends Item 68 on the fundamentals of IPSEC such as key exchange and authentication, then goes on in Item 69 to discuss the details of implementing IPSEC via policies in a domain. He covers client and server configurations, then gives rationale for selecting various options. He also talks about why it's not the best solution, or even a complete solution, but does point out where IPSEC makes sense.

COM programming gets an entire section/part to itself, and Brown does a great job explaining the complex issues surrounding securing COM(+) communication. He discusses Authentication, Impersonation, and what calls you need to make in your Main method to properly invoke various COM security aspects.

Threat Modeling gets its own Item, but isn't covered in great depth. Brown lays out Microsoft's STRIDE system (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege) as a guideline for threat modeling. He also talks a bit about attack trees. Neither topic gets substantial treatment; however, Brown makes it clear he's only introducing these topics and points readers to several other resources such as Swiderski and Snyder's Threat Modeling. Great List of Cons and Problems

Part of good software engineering is understanding the ramifications of choices you make. Brown's very good about laying out the "Why" for his items, plus he's also clear where hard choices have to be made.

For example, in his discussion of IPSEC he asks "Where is IPSEC useful? When you don't have any better alternatives." He goes on to show how IPSEC can be used to help COM servers talk securely, or in .NET Remoting under the 1.1 Framework which stupidly doesn't provide secure communication channels.

Another example might be the erasability of a secret under .NET. Managed environments such as .NET and Java don't make it easy to ensure secrets (passwords, keys, etc.) can be erased out of the managed memory heap or at least overwritten immediately after their purpose is fulfilled. Not only can the object's memory be left unerased, but what about controlling whether it's written out to a swapfile? Brown points out these sorts of issues and tries to point out how to deal with them. What the Book Doesn't Cover

Brown's book isn't so much about specific coding techniques, although there are a fair number of those within. You won't find specifics on .NET's code access security, or issues around cross-site scripting. You'll need to look to Howard and LeBlanc's Writing Secure Code for code specifics.

Rather, the book is more about approaches to secure development on Windows. Brown's book also isn't about security and threat analysis, but again, he's forthright about that and points readers to other sources.

Bill Wagner, author of Effective C#, points out on his blog that Brown's book would be more usable if "titles [were] organized around the tasks I need to perform." I think that's a good criticism - a cookbook format would be a great improvement for a second edition. Summary

The book's very well written with a good index and a terrific Bibliography which serves as a great reading list for furthering one's knowledge of security on the Windows platform.

I've found the book very educational and useful. It's an important addition to my bookshelf and has already helped me with a couple of important topics. I think any professional, contentious developer working in the Windows environment would find this a vital addition to their bookshelf as well."

---

You can purchase The .NET Developer's Guide to Windows Security from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

World's Shortest Books

From Amazon.com:

Customers who bought this title also bought:

• My Plan To Catch The Real Killers by O. J. Simpson
• My Little Book of Marital Ethics by Bill Clinton and Rev. Jesse Jackson
• 101 Iraqi Exit Strategies by G. W. Bush

I have this on my bookshelf...

...next to "Building Castles on Sand".

Of course it's possible

There's Firefox and Apache for Windows, isn't there?

Here's a thought

Instead of bashing MS and Windows, prove that you're the better programmer by compensating for the sometimes flawed security. If you don't think users can trust their OS, at least you can take pride in the fact that they can trust your software running on it. A solid piece of software is just as impenetrable on Windows as it is on Linux or any other platform - it's all about understanding the environment. Looks like a great book, thanks for the review.

Re:Here's a thought

Io be honest, I think that isn't entirely true, there are many different vectors of attack.. the best we (as developers) can do is make sure it isn't because of *our* software. We can check input before processing, we can use proper error handling to prevent a default error handler from exposing a dbms password. We cannot fix windows services, or software we rely on...

However, I have to submit that most of the time security exploits in windows, are user initiated. Reduced privileges for default users would be a great improvement.. aside from that, we must bear personal responsibility for what we create.

Re:Here's a thought

A solid piece of software is just as impenetrable on Windows as it is on Linux or any other platform

Hmmmmn....How about if I change your statement to:

A solid piece of software is just as impenetrable on Windows 95 as it is on Windows XP Professional or any other platform

This statement is incorrect - Windows 9x Filesystem (for starters) makes your program's config files (or hell binary) overwriteable by anyone in the system.

So you see - the OS is important.

It only works if you read it before hand...

Brown's book should be on any .NET Developer's bookshelf

Just putting it on the bookshelf won't help - ya need to read it before you put it there.

On a related note, this pretty much rules out all the developers I work with - if you can't get it as a Book-On-iPod, they aren't interested these days =-)

Cue jokes...

Windows has come a long way in the last 5/6 years and vista should ship reasonably secure out of the box. It's still an unbelievably shitty OS peddled by an objectionable bunch of borderline criminals, but you have to give them credit for addressing security issues.

Anyone else see

Anyone else see the irony in having two articles on the front page of /. one of which is about secure coding and the other which is about "How To Write Unmaintainable Code"

Or maybe making it unmaintainable is just a sneaky way of developing securely...
the /. editors are sneakier than i gave them credit for

Why should I be laughing?

Can you point me to any OS where security is automagic and the developer doesn't need to consider it? Windows may have its problems and more than enough shitty architecture, but security must be considered in the design of Mac and Unix/Linux programs as well.

I'm not laughing

I'm going to read this book.

I am forced to develop windows applications from time to time, and I am ashamed of the poor security of many of these apps. It is definitely something that should be addressed. There are hundreds of thousands of part-time windows developers who know even less (gasp!) than I do about security.

/me gets back to hard-coding plaintext database passwords.

start with an interpreted environment.

Managed environments like .Net, Java, Python, etc. are a good start, but aren't the end of things. Most principles in security are similar regardless of platform. I do think a lot of the issues in windows security come from poorly written software that doesn't work properly in reduced security contexts... It's nearly impossible to develop on windows without administrative access to the machine you're working on.

At least with a managed environment, you have less chance of attack channels which result from unchecked data. You still have to consider how software is used, what it connects to, and check data going to an rdbms in environments that don't do it for you (parameterized queries for ADO.Net are pretty nice).

Let me guess???

Chapters 4-6 deal with setting up VMware on linux?

a conversation

CWS: Hello secure app, I'm coolwebsearch!
SA: Hi, I'm busy.
CWS: HEEY! Look at me!
SA:Uh-huh.
CWS:You sure are secure aren't you?
SA: Sure am.
CWS: Hey, let's see which one of us is more important!
SA: Whatever.
CWS: MR PROCESS MANAGER!!! WHICH ONE OF US IS MORE IMPORTANT???
Windows PM: It looks like you're trying to type a letter...
CWS: YAAY! You know what,this sucks, I'm just gonna take all of the CPU cycles and all the network bandwidth now!
SA:...!!...No..Must...keep......working..m....u... ....sT......
Windows PM: Well, it looks.... like you guys..... are busy, I'm gonna take a n......ap. Wake me up if anyone starts writing............... letters.kbyethx... ...
BSD: "Pleased to meet you, Hope you've guessed my name..."

I think we're missing the point here...

A chain is as strong as its weakest link.

The point is making sure your app is NOT the weakest link here, i.e. allowing a virus to inject code thru a buffer overflow or something. And we're living in post-Sony times, it was bad enough with viruses - just wait till the rootkits start spreading.

Attack trees

"He also talks a bit about attack trees." but doesn't discuss them thoroughly. I wish somebody would. I *really* wish there were a Web site devoted to them--something like design patterns. Perhaps powered by a Wiki.

Where they're even known about, say by people who have read Secrets and Lies (Schneir 2000), far too many developers are forced to reinvent the wheel. This hurts security in a fundamental way. All too often, they've never been heard of. I'm glad they're getting some mention, on any level.

No, really

"No, really. Please pick yourself up off the floor and stop laughing. Yes, there are good books on developing Windows software in a secure fashion." With snippets like that starting off an article, you start to see why people have trouble taking Slashdot seriously. This is getting ridiclous, almost FOXNEWSesque.

Hate to do this but

this book can be read online for FREE as in beer or something. If you want it in one document you may have to get your "copy and paste" on, or if you are in hacker fever you could screen scrape it. Anyway http://pluralsight.com/wiki/default.aspx/Keith.Gui deBook.HomePage [pluralsight.com] yep all there for your Windows security mokery.

Remember this is to build secure software on Windows, something that should not be frowned upon even if those who write Windows don't listen to this advice. So when your next Window app breaks and your customer is irate, you can say "uh uh that's MS Slammer 5002, that's a bug with Windows not my code buddy!! I know my shit and that's why you're paying me too much to do this, now stop bugging me already, don't you accountants do anything but make cups of coffee all day!!!!"

Read the Book.

Developing Secure Software

Developing secure software should always be platform independent. But security for developing an application does not stop at the developer, it continues through to the system administrators and the users. We've all heard software is only as secure as the O/S its running on, well its also as secure as the administrators/users running it. Security should be practiced at all levels from development to roll out and installation and through its entire lifetime. No software is completely 100% secure, so if flaws pop up after development patches should be available ASAP.

Free Online

The book was developed online via a Wiki, available here [pluralsight.com] for free. This is a great book that every windows and .NET developer should be aware of.

Wndows=security?

SELECT * FROM Windows WHERE security > 0
fatal error segmentation fault

Attack Trees effectiveness

"Threat Modeling gets its own Item, but isn't covered in great depth. Brown lays out Microsoft's STRIDE system (Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege) as a guideline for threat modeling. He also talks a bit about attack trees."

Didn't Gandalf use the assistance of Attack Trees to topple Isengard? Sarumon really needs to read this book.

But seriously folks....another good reference here:
http://www.microsoft.com/MSPress/books/5957.asp [microsoft.com]

Steps one through four

Step one: Unplug from network
Step two: Shut down
Step three: Use power button to kill hung shutdown
Step four: declare victory! you have successfully secured windows

a secure windows program

int main( int argc, char** argv )
{
    return 0;
}

Hah!

The Encyclopaedia Galactica, in its chapter on "Developing Securely In Windows", states that it is far too complicated to define. The Hitchhiker's Guide to the Galaxy has this to say on the subject:

"Avoid, if at all possible."

seen Get Smart?

That one ep where Max spends like 20 minutes navigating traps, huge vault doors, combination locks etc etc... then finally at the last one it won't let him in, so he walks 10 feet down the hall to another door and walks right in.

Secure apps are worthless without a secure OS to run them.

You need a good foundation

You can use the best building materials available to modern man, sparing no expense, but your construction will never be as stable as it could be if you're building on swampland.

Windows is swampland.

Microsoft and IPSEC

When the leader of the Free S/WAN project went up to MS to do some interoperability testing, the first thing he asked was: "Ok, what crypto protocols have you implemented that we can test?" They told him "40-bit DES". That was all. Once he realize that they were serious, he just left.

To MS, "Security" is nothing more than a checkbox on a feature list. They don't care about your data security, and they really don't have the skill to help you if they did care.

-jcr

three steps

step 1:
format c:
step 2:
insert *nix install disk
step 3:
install (this probably makes step 1 pointless, but we're talking security, better safe...)

Re:No such thing ..

If the underlaying closed source API has bugs there's nothing much you can do about it.

Does this mean that any system with bugs is not worth developing for? And if this is true does it mean that developers who code third party software should be absolved of any wrong doing? That's just nonsense to me. MS may not have a great product out there on the terms of security but the kind of retards at AOL who are coding weakly and creating a number of the exploits being used certainly are at fault.

If we hold ourselves to only the highest acheivements of the worst developers we're all going to be in trouble.

And what of those that have to use Windows? You may sit high and mighty and laugh about this but some of us are paid to code for Windows. Are we suppose to go find all those Linux jobs that I keep hearing of just because MS writes bad code? That's like quiting a company after finding that a CEO high up embezzeled (sp??) funds.

Re:This book is already outdated!

Most of the techniques mentioned are still useful (if you're a .net lamor), but a lot of information is outdated.

How can something be useful and outdated? If outdated, to me, means that something has lived past it's usefulness.

Re:Here is the chance..

Christ man all the moderators must be windows admins tonight. Seems like every crack at windows is being modded down. You know what...screw you moderators I bless this poster with...well my make believe funny moderation

Nah Nah na boo boo!

Re:one fundamental flaw

This strikes me as akin to a manual explaining how to install top-notch door locks and biometric ID systems in a house with paper mache walls.

I stand by [slashdot.org] my initial argument, regardless of the opinions of the moderators.