What the bad guys will try and what ASP.NET 2.0 does to protect you! Rui Quintino DevScope

Apresentação em tema: "What the bad guys will try and what ASP.NET 2.0 does to protect you! Rui Quintino DevScope"— Transcrição da apresentação:

1 What the bad guys will try and what ASP.NET 2.0 does to protect you! Rui Quintino DevScope rui.quintino@devscope.net http://weblogs.pontonetpt.com/rquintino

2 Agenda Segurança Aplicacional Ataques Comuns Soluções Novas Funcionalidades ASP.NET 2.0

3 NetworkHostApplication Spoofed packets, etc Buffer overflows, illicit paths, etc SQL Injection, XSS, input tampering, etc. Threats against the Network Threats against the Host Threats against the Application

4 Segurança Aplicacional Tão importante como a segurança de servidores e de rede Foco na equipa de desenvolvimento SSL, Firewalls, Anti Vírus & HotFixes são imprescindíveis, mas não garantem a segurança aplicacional 75% dos ataques informáticos exploram falhas aplicacionais – Gartner Group

5 Ataques e Soluções Demonstrações

6 Conclusão Validar! Validar! Validar! Não confiar em dados com origem externa à nossa aplicação Defesa em profundidade

7 Recursos Improving Web Application Security: Threats and Countermeasures http://msdn.microsoft.com/library/default.asp?url=/library/e n-us/dnnetsec/html/ThreatCounter.asphttp://msdn.microsoft.com/library/default.asp?url=/library/e n-us/dnnetsec/html/ThreatCounter.asp Building Secure ASP.NET Applications http://msdn.microsoft.com/library/default.asp?url=/library/e n-us/dnnetsec/html/secnetlpMSDN.asphttp://msdn.microsoft.com/library/default.asp?url=/library/e n-us/dnnetsec/html/secnetlpMSDN.asp P&P ASP.NET 2.0 Security Guidance http://msdn.microsoft.com/library/default.asp?url=/library/e n-us/dnpag2/html/ASPNET2SecurityGuidanceIndex.asphttp://msdn.microsoft.com/library/default.asp?url=/library/e n-us/dnpag2/html/ASPNET2SecurityGuidanceIndex.asp Writing Secure Code (Michael Howard, David LeBlanc )

8 Recursos Patterns & practices Security Training Modules Pilot http://channel9.msdn.com/wiki/default.aspx/Security Wiki.SecurityTrainingModuleshttp://channel9.msdn.com/wiki/default.aspx/Security Wiki.SecurityTrainingModules OWASP (.NET) http://owasp.net/default.aspx FoundStone Whitepapers http://www.foundstone.com/resources/whitepapers.h tmhttp://www.foundstone.com/resources/whitepapers.h tm

9 Perguntas/Feedback Mail rui.quintino@devscope.net Blog http://weblogs.pontonetpt.com/rquintino